03d38687d940d9f5e1c5a22892511526a9de9b2b577bedfe710ee65544b32020

Analysis

user interaction
yes
max time kernel
344s
max time network
428s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
otclientv8.bat
Size 2KB
Sample260809-xv4qysca63
SHA256 03d38687d940d9f5e1c5a22892511526a9de9b2b577bedfe710ee65544b32020
MD5 367104caf1b19083c8f57bbbddd00b79
SHA1 d8a34951a7761d77ee760dac5b6a4d78d24d2ea3
SHA512 24b522de3987435a9a5375a1c000bf96cf52fd7e624f0958a1f8b161e62ce2543a3c36c6e2063f168d614754b246e3f5c3089a6e1a7d4240705a61c387fd0b4a
TLSH
T158516A4E3E12AAAF3575CF494E954144FA00424B4E0E0B9AF09F827C2B473823AFD4D9
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\BTHUSB.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fr-FR\sdbus.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\acpi.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\en-US\partmgr.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\sermouse.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\usbhub.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\intelpmax.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\vmgencounter.sys	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\it-IT\ndiscap.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\rdbss.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\tsusbflt.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\fr-FR\WUDFUsbccidDriver.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\NDKPerf.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\UnionFS.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\SensorsCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\AppvVemgr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\atapi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\cdrom.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\en-US\qwavedrv.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\afd.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\nwifi.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\pnpmem.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\kbdhid.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSSi_GPIO.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\iorate.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\partmgr.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\refs.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\KNetPwrDepBroker.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\lltdio.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\mspclock.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ws2ifsl.sys	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\es-ES\NdisImPlatform.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\en-US\VerifierExt.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\it-IT\nwifi.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\MbbCx.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\mspqm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pnpmem.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdmCompanionFilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wfplwfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\tcpip.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\wudfpf.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\ndisuio.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\wacompen.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\bowser.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\hvsocket.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\ibbus.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\megasas35i.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\mssecflt.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\es-ES\qwavedrv.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\it-IT\mgtdyn.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\adp80xx.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\en-US\fvevol.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidbatt.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\asyncmac.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ksecpkg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ja-JP\IPMIDRV.sys.mui	attrib.exe
File opened for modification	C:\Windows\System32\drivers\crashdmp.sys	attrib.exe
File opened for modification	C:\Windows\System32\drivers\en-US\PktMon.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mausbhost.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sbp2port.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\spacedump.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kbdclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\NDKPing.sys	cmd.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\System32\wintrust.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5820	takeown.exe
2580	icacls.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	attrib.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
5016	Process not Found

Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageManagement%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-PCI%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Setup.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AAD%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4KeyMgmt.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PCW%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Biometrics%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Cache%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Internet Explorer.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Device Management.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\OAlerts.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Admin.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	attrib.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudFiles-Filter%4Operational.evtx	attrib.exe

Loads dropped DLL 8 IoCs

pid	Process
5016	Process not Found
5016	Process not Found
5016	Process not Found
5016	Process not Found
5016	Process not Found
5016	Process not Found
5016	Process not Found
5016	Process not Found

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5820	takeown.exe
2580	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	attrib.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.26100.1150_none_16c5cc95ed81961d\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.26100.1_none_7f736e321868c082\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	attrib.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.26100.1_none_7d46065ee5cd8613\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM065C~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.26100.1591_none_3a4593a9a3a42262\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.26100.1_none_760a3fa79d0dd71f\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.26100.1_none_d75f0561e5d53d5b\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5558~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3D7A~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.26100.1_none_1d9f561f4c141236\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.26100.1_none_e90ac44521f6781d\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.26100.1_none_1d9f561f4c141236\Desktop.ini	cmd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Windows\Media\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.26100.1_none_d3c9385d0d7f8e4f\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.26100.1_none_53f4413b5b0ec6c8\desktop.ini	attrib.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	attrib.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	attrib.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themeb_31bf3856ad364e35_10.0.26100.1_none_d3c94f250d7f74ae\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.26100.1_none_80d96be390261ff6\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.26100.1_none_d939b1ba77084dd2\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.26100.1_none_4bc4edc230be4464\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.26100.1_none_20f7d6167cb25b4e\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.26100.1_none_6038226271499ae0\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2879~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.26100.1_none_80d96be390261ff6\desktop.ini	attrib.exe
File opened for modification	C:\Windows\WinSxS\AM4A4F~1.115\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM01A8~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA8BC~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD54F~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\desktop.ini	attrib.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	attrib.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	attrib.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-PictureTools-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat	attrib.exe
File opened for modification	C:\Windows\System32\NDF	attrib.exe
File opened for modification	C:\Windows\System32\Dism\CbmrProvider.dll	cmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat	attrib.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Presentation-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat	attrib.exe
File opened for modification	C:\Windows\System32\msasn1.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\uk-UA	attrib.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ja-JP	attrib.exe
File opened for modification	C:\Windows\System32\fr-FR\ole32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\vbscript.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Win0-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat	attrib.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Network-Connectivity-Assistant-Service-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat	attrib.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\devmap.inf_amd64_1993197f4612e967\devmap.sys	attrib.exe
File opened for modification	C:\Windows\System32\uk-UA\Windows.Web.Http.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\CimCmdlets\CimCmdlets.psd1	cmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat	attrib.exe
File opened for modification	C:\Windows\System32\Dism\fr-FR\DismCore.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\es-ES	attrib.exe
File opened for modification	C:\Windows\System32\backgroundTaskHost.exe	attrib.exe
File opened for modification	C:\Windows\System32\es-ES\resutils.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\winrm\040C\winrm.ini	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\NTPRIN~1.INF\Amd64\PCL5URES.DLL	cmd.exe
File opened for modification	C:\Windows\System32\tcpmon.dll	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\fidocredprov.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wpdbusenum.dll	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\rekeywiz.exe.mui	attrib.exe
File opened for modification	C:\Windows\System32\uk-UA\tsgqec.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\wvid.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\sessionmsg.exe.mui	attrib.exe
File opened for modification	C:\Windows\System32\wmdmps.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\F12	attrib.exe
File opened for modification	C:\Windows\System32\migwiz\fr-FR\UserSettingsBackup.BackupUnitProcessor.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\AuthExt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\sud.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\ja-jp\Windows.SharedPC.CredentialProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\ProximityCommon.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterPowerManagement.Format.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\en-US\Windows.Internal.SecurityMitigationsBroker.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}	attrib.exe
File opened for modification	C:\Windows\System32\en-US\DataExchangeHost.exe.mui	attrib.exe
File opened for modification	C:\Windows\SysWOW64\cfgmgr32.dll	attrib.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\vdrvroot.inf_loc	attrib.exe
File opened for modification	C:\Windows\System32\workfolderssvc.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\msyuv.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\windows.internal.shellcommon.AppResolverModal.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterBinding.cmdletDefinition.cdxml	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\whealogr.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\msrahc.dll	attrib.exe
File opened for modification	C:\Windows\System32\SystemPropertiesRemote.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\BluetoothApis.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wmidcom.dll	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\cmcfg32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\energy.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\CapabilityAccessManagerClient.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\dsregtask.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\en-US\DevDispItemProvider.dll.mui	attrib.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetworkSwitchManager\CmdletHelpers.psm1	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prnmngr.vbs	attrib.exe
File opened for modification	C:\Windows\System32\it-IT\Windows.Media.MediaControl.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\kmddsp.tsp.mui	cmd.exe
File opened for modification	C:\Windows\System32\cmpbk32.dll	cmd.exe
File opened for modification	C:\Windows\System32\driverquery.exe	cmd.exe
File opened for modification	C:\Windows\System32\en-US\compmgmt.msc	attrib.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ACPIPM~1.INF\acpipmi.sys	cmd.exe

Modifies termsrv.dll 1 TTPs 2 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	attrib.exe
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\prefs_enclave_x64.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png	attrib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB	attrib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms	attrib.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecurityAppList.targetsize-256_altform-unplated_contrast-black.png	attrib.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.scale-400_contrast-white.png	attrib.exe
File opened for modification	C:\Program Files\MergeClose.vssm	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-default.svg	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\vulkan-1.dll	attrib.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	attrib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	attrib.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll	attrib.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac	attrib.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7models0404.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Full.aapp	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll	attrib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\npt.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\RMNSQUE.ELM	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFPROXY.DLL	attrib.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\PesterThrow.ps1	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.DATA	attrib.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui	attrib.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\es-ES	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\ui-strings.js	attrib.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css	attrib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\he-IL	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\oregres.dll	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\ml.pak	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.dll.sig	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\lb.pak	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\psmachine.dll	attrib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md	attrib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg	attrib.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.INF	attrib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo	attrib.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotContain.snippets.ps1xml	attrib.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM8243~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\SETTIN~1\AMBA08~1.MAN	cmd.exe
File opened for modification	C:\Windows\Boot\EFI\pl-PL	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-directx-gpm_31bf3856ad364e35_10.0.26100.1591_none_17f04ce99d910742\r	attrib.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_10.0.26100.1591_none_b3bd3acb19f9bfa6_scardsvr.dll_b84d047c	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..lient-scheduled-adm_31bf3856ad364e35_10.0.26100.1_none_08ee94a5921c787b.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\PR823E~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-runtime-mtxdm_31bf3856ad364e35_10.0.26100.1150_none_b3d76857835674b0\mtxdm.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMB527~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WO5B0C~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_mshdc.inf_31bf3856ad364e35_10.0.26100.1150_none_b75f023a7f698942\pciidex.sys	attrib.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.26100.1591_en-us_b30301a4b143f570_dnsapi.dll.mui_97465f8a	attrib.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_7129815d3059df8c.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.26100.1_en-us_5e5bf64d5b3ca824.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-volsnap_31bf3856ad364e35_10.0.26100.1150_none_fb1145ff515a284a	attrib.exe
File opened for modification	C:\Windows\WinSxS\AMC307~1.115\SETTIN~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM433C~1.1_H\TIPRES~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..imeserver.resources_31bf3856ad364e35_10.0.26100.1_en-us_3c22d73791b0f6e3\assignedaccessmanager.dll.mui	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_10.0.26100.712_none_165557fe524fa9ca.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..-mscandui.resources_31bf3856ad364e35_10.0.26100.1_it-it_a543f4881d32c807	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\AM76A9~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_nvdimm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6c53d6b617d1a68f\NVDIMM~1.INF	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..oning-wmi.resources_31bf3856ad364e35_10.0.26100.1_es-es_026c9a8f2c78e13e\MSPSPR~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..g-xpsdocumentwriter_31bf3856ad364e35_10.0.26100.1_none_1fcc474acb92e436\MXDW-P~1.XML	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-o..y-webauth.resources_31bf3856ad364e35_10.0.26100.1_de-de_aaadb64b34e87a94\AUTHBR~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-umpnpmgr.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_0558bf80e41eec50\umpnpmgr.dll.mui	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-b..ment-core-utilities_31bf3856ad364e35_10.0.26100.1_none_627d1ea242511b91.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\AMD04E~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-msxml30.resources_31bf3856ad364e35_10.0.26100.1_de-de_8dc1b42cc07bcfb5\MSXML3~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM7DCB~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMA7C0~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO088C~1.159\r\LOCKSC~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\X87E70~1.1_N\odbccu32.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_netlldp.inf_31bf3856ad364e35_10.0.26100.1_none_bb463b4f28e3b0b2\netlldp.inf	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_7d7d4dad15d09e90	attrib.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-onecore-a..nmodel-datatransfer_31bf3856ad364e35_10.0.26100.1000_none_c5d6dfd001188777	attrib.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\540a2ed732e69d4b209fc8b751a542049642e5e6a47dbc8288ba1b1bd70491c0.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7DDB~1.159\r\IKEEXT.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMD45B~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO84A6~1.1_N\MSDTCF~1.PS1	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIC5CB~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..lerevocationmanager_31bf3856ad364e35_10.0.26100.1591_none_b342a51ffdf0219a\efswrt.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM190E~1.1_U\RS_RES~1.PSD	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMA6BC~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM31F5~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMA0EF~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM6298~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\MS18D2~1.MAN	cmd.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\hc1.theme	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..ppolicies.resources_31bf3856ad364e35_10.0.26100.1_es-es_9252a0107f19139c	attrib.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1591_none_beaf2c777621abf2\r\icu.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMCF6A~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-mui-settings_31bf3856ad364e35_10.0.26100.1_none_b7037ae199d39883.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-t..i-appcore.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_ee6740c92bdc403a.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\WO1C26~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\SETTIN~1\WO1865~1.MAN	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Design.Resources.dll	cmd.exe
File opened for modification	C:\Windows\Fonts\vgafixg.fon	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-wimgapi.resources_31bf3856ad364e35_10.0.26100.1_it-it_a2f60590f339b6d3.manifest	attrib.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.26100.1_it-it_00372b9016bb5e7d	attrib.exe
File opened for modification	C:\Windows\WinSxS\Manifests\AMBEDF~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-themeservice_31bf3856ad364e35_10.0.26100.1591_none_45c27bd278636d9a\r\THEMES~1.DLL	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
5060	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2204	4120	cmd.exe	90
PID 4120 wrote to memory of 5820	4120	cmd.exe	92
PID 4120 wrote to memory of 2580	4120	cmd.exe	93
PID 4120 wrote to memory of 5060	4120	cmd.exe	94
PID 5060 wrote to memory of 2736	5060	cmd.exe	95
PID 5060 wrote to memory of 5072	5060	cmd.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2204	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\otclientv8.bat"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\system32\attrib.exe
  attrib -h -s -r "C:\\*" /s /d
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Boot or Logon Autostart Execution: Print Processors
  - Creates a file in the Startup directory
  - Indicator Removal: Clear Windows Event Logs
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2204
- C:\Windows\system32\takeown.exe
  takeown /f "C:\" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5820
- C:\Windows\system32\icacls.exe
  icacls "C:\" /grant Administrators:F /t /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\" /ad /b /s 2>nul | sort /r
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir "C:\" /ad /b /s 2>nul"
    3⤵
    PID:2736
- - C:\Windows\system32\sort.exe
    sort /r
    3⤵
    PID:5072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
1⤵
PID:5004

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2152
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:5084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2372

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4812
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4132

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1720
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3416

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2588
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5324

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1128
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1936

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3048
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1700

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5452
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5936

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4980
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5564

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1824
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4260

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3040
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3680

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1972
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2904

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2040
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2696

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4232
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3336

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1916
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2740

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2232
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5352

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4428
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4316

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4956
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4364

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4496
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:832

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5756
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3028

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5136
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5000

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4288
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3896

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5368
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3452

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3716
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4336

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5672
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5872

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4148
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5932

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5732
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1664

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6016
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2600

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:200
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6060

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3248
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4388

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3708
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5652

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3536
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3808

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4864
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1872

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2976
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4672

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2668
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4464

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5888
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5884

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1000
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4816

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5548
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:916

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3320
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3352

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3572
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5512

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5632
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:976

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4892
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2824

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4912
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4516

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2772
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6132

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3276
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2940

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5264
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1760

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1296
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3780

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2028
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5524

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4696
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2580

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2472
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3036

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4856
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:944

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3296
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1008

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1184
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5080

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2400
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4176

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3400
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3540

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3908
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2456

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3568
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1316

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:876
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2532

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3804
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:716

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2860
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:700

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5916
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3412

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1764
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6124

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2964
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2892

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2404
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2500

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1940
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5636

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5048
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:908

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4716
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2172

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1832
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1220

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4196
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:824

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3180
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2924

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3152
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1412

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5536
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:180

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2944
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3980

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6044
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6072

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2548
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4204

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1048
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2252

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4660
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1080

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1564
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4600

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3100
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2840

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4024
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3240

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3468
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4000

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:252
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4664

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1624
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5360

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4636
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4700

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2848
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3956

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5896
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4776

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5128
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4252

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5328
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4820

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3232
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4264

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5164
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5976

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1424
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6112

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2164
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3280

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4800
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2796

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2496
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3060

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:480
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6108

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4220
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2800

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4608
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1312

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1176
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4248

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4160
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1372

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1268
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3692

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1148
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3392

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2108
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5692

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2672
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5952

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4432
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4072

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2536
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1856

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5196
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2492

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1204
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2576

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4008
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4240

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4852
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4604

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1196
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6032

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5708
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3696

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2628
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5552

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3752
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4300

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1820
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4540

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3688
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5816

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5784
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5404

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5720
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4504

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2832
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1752

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2676
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2572

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1888
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:528

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1716
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2440

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2700
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5596

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1912
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4040

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:52
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1552

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3512
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1748

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5076
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2804

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2736
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1628

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4996
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3600

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5180
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:432

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5680
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5688

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1780

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1252
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5604

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3224
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4948

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2624
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3000

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4780
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2476

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3504
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5480

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4960
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5008

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2844
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2528

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3624
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5852

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5508
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1732

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4080
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:712

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1808
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4032

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2052
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1876

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5104
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3220

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2544
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2680

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2760
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:108

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1256
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2640

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:484
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3988

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:236
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4224

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3044
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1152

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4904
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3164

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2292
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2468

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5824
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5444

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2364
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4348

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3448
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4140

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1704
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1944

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4520
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3104

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3396
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1460

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2036
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5880

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4628
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5812

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2396
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4380

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5924
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3356

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4764
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4736

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4752
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1408

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2716
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5124

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1540
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5640

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3640
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5696

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2980
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3576

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4420
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4944

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6384
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6400

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7012
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7028

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6180
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6236

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6900
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6544

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5608
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6348

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6548
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6912

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3732
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7140

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6256
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2636

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6192
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6488

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6716
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:848

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5972
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3172

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4392
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5200

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6788
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1440

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6536
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:436

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6584
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2564

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6800
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2012

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7076
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6692

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6756
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5600

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3544
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4244

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3888
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2236

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6484
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6208

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1096
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6712

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6920
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3760

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6980
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6228

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3216
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6660

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6868
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1672

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7040
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4020

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1360
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6368

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6288
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2720

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:120
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6768

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6948
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4544

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4884
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6404

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2960
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5092

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6540
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6084

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4156
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2916

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6808
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3268

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2428
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2920

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6360
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5752

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6616
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6416

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6468
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6924

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4012
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3056

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6156
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6612

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3136
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6460

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4088
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2888

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6268
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3724

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6984
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6932

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6752
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6944

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4100
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6704

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2688
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:488

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5648
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6940

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1100
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1988

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6864
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6684

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1952
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7128

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3080
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5568

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6952
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6312

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7044
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6744

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1392
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4872

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5252
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4284

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2368
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1860

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7020
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2128

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2212
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6436

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2972
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6292

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:996
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6380

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2776
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3900

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6776
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:856

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6764
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2356

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6464
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6580

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6440
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3140

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4688
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2192

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4344
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4624

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6364
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6224

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4616
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6988

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6264
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6816

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6508
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7088

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7008
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4208

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5272
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5504

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7116
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2008

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2016
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6324

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4728
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4152

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5940
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:940

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:932
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6908

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7108
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4172

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3440
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6272

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3192
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4824

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3236
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6740

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3660
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6028

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6492
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4460

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7016
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6336

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6148
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6452

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4328
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6472

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6212
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6244

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3596
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5556

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4016
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5740

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6748
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6904

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4312
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6812

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6352
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3360

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:980
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2296

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6968
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6836

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6588
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6164

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2568
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6696

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:4828
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5276

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6344
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6664

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6320
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6600

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:696
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6608

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5440
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5864

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1188
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1800

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5160
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6512

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5724
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4192

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6316
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4908

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6848
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3832

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6852
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:1428

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5700
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5736

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7388
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7404

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7996
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:8012

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7232
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7240

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7476
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7432

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:8188
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7224

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7504
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7500

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:8112
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7364

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7348
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7048

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7532
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7920

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:8068
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6172

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7964
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3092

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7968
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2856

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7792
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7612

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:8156
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7204

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5532
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3328

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7216
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:5024

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7192
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7856

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6936
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7980

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1984
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7564

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1004
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2996

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6572
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2160

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6672
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7480

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2340
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7544

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6856
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6708

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7172
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6304

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7260
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7344

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7740
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3052

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3228
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7916

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:8092
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3432

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7444
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:6220

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7112
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7180

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6200
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:8064

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7184
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7756

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:6840
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4992

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:8024
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7468

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7824
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:7440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 99KB
SHA256 f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902
MD5 d346530e648e15887ae88ea34c82efc9
SHA1 5644d95910852e50a4b42375bddfef05f6b3490f
SHA512 62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673
SSDEEP 1536:mCkXPxYbAVFYytdtXD571K8XQui+aFBZxH3OwenyrKm5GDES575Y+NPyFG:dmxDF5tGVFBZxHeB46VYdG
TLSH
T1F6A3C625B664C335D073D0BAC9C2AA99EA7178419F304BCF6246A74D1E36BDACC35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VISSHE.DLL

Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
Size 279KB
SHA256 7a83319f41c626818556e406b5b664aa4c102cb851269e9becbe3041bde4368a
MD5 7efcf0111eb7a22aec8410d6a427b328
SHA1 d6828e7c4fb2789da55899e69c6197eaf4017b88
SHA512 c1526e7bfe3c9f5d9ea9ab0f18d555e01f107ec56123ab83b8677ac24da57e206fb02a0148d2ae08ceba6ec4c10f42a46b0093e2324c0d723f09ec1fd4f43d97
SSDEEP 3072:chODtLp34ulhWpOUpTEmqHWDA10fFT1u4qnHqneFIFryVKtANp8JPTl31e07CWvz:GsRCUwTEnkW+NyVIANpKJ1etWU77M
TLSH
T1285491C2FBE648E2EC52673C84BF462EAFF5F9300571C22F0DD091998DAB7484D2565A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoshext.dll

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Size 1.7MB
SHA256 606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0
MD5 c606bd7c9c733dd27f74157c34e51742
SHA1 aab92689723449fbc3e123fb614dd536a74b74d4
SHA512 5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38
SSDEEP 24576:HcT4tSLLxH7lk1YzRJGEXF2xFFdVtFD/4AGyw5JxAfRrMDtWbtxrTHeN:HFAyE9XwfTTx+JSmDQxrT+N
TLSH
T19885272167FD5094F1BB863898BBA976FDBAB6411870F21F0520C16E1F36F20993D726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
Size 613KB
SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
MD5 c1b066f9e3e2f3a6785161a8c7e0346a
SHA1 8b3b943e79c40bc81fdac1e038a276d034bbe812
SHA512 36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
SSDEEP 12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
TLSH
T19DD40927AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll
Size 83KB
SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
MD5 1453290db80241683288f33e6dd5e80e
SHA1 29fb9af50458df43ef40bfc8f0f516d0c0a106fd
SHA512 4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
SSDEEP 1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
TLSH
T169837D4577E402BAE06BD074C0A29E47FB72B585873047DF036996AE0F53BE24E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IC5758~1.DB

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\IC5758~1.DB
Size 24B
SHA256 67219e5ad98a31e8fa8593323cd2024c1ca54d65985d895e8830ae356c7bdf1d
MD5 635e15cb045ff4cf0e6a31c827225767
SHA1 f1eaaa628678441481309261fabc9d155c0dd6cb
SHA512 81172ae72153b24391c19556982a316e16e638f5322b11569d76b28e154250d0d2f31e83e9e832180e34add0d63b24d36dd8a0cee80e8b46d96639bff811fa58
MD5 SHA1 SHA512

Submit Download

IC6701~1.DB

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\IC6701~1.DB
Size 24B
SHA256 5a00cc998e0d0285b729964afd20618cbaecfa7791fecdb843b535491a83ae21
MD5 2dd3f3c33e7100ec0d4dbbca9774b044
SHA1 b254d47f2b9769f13b033cae2b0571d68d42e5eb
SHA512 c719d8c54a3a749a41b8fc430405db7fcde829c150f27c89015793ca06018ad9d6833f20ab7e0cfda99e16322b52a19c080e8c618f996fc8923488819e6e14bb
MD5 SHA1 SHA512

Submit Download

ICONCA~2.DB

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ICONCA~2.DB
Size 24B
SHA256 c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424
MD5 419a089e66b9e18ada06c459b000cb4d
SHA1 ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a
SHA512 bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c
MD5 SHA1 SHA512

Submit Download

icn740B.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete\icn740B.tmp
Size 7KB
SHA256 d137bf1b3c4acbe9ade2f74592d43d4a8370f91221225e6915880c8cf46450d9
MD5 028e5a07ede31936ad4bce6a9f52088d
SHA1 6bbc2662b3941964fc9e68fb60fe6b37c64711b5
SHA512 af35619ad927e1ae466fc1401de3f5d71f2ef8c0b6b5f45876b26b9477341838a04a73063e4c510cfc7f8dcbe0454515ba3d04423cf835759289d394056d5ad4
SSDEEP 3:tnuolllQlF:ftw
MD5 SHA1 SHA512 SSDEEP

Submit Download

icn740C.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete\icn740C.tmp
Size 24B
SHA256 35bc77a06bfdde8c8f3a474c88520262b88c7b8992ee6b2d5cf41dddc77a83fb
MD5 60476a101249aedff09a43e047040191
SHA1 de5b6a0adc7de7180e19286cf0f13567278cdb64
SHA512 f1d2dcc562a36434c6c6405ec4eac7ecfa76fc5a940114da6f94495b77584a132d5d82ad3556df749490be096cfd238fa8b484b7c734cbc4d074e963e5d451f4
MD5 SHA1 SHA512

Submit Download

iconcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 10ef5c281972cac30f6df36af447ce2271b1d46dd309b052954070003be5b153
MD5 1d41d647faf0c99af43c89459acc8e9f
SHA1 0012ef2ce91e7a8e0286bafe1f51d1251120bfec
SHA512 5c09c6a6dcf4f5c26c073d8d989ce3d2ebb179d5bdff78d9a8488da992f9cfafee150388bcc6581da57912d3178a87535139661a0c488ef527553161f08498ef
SSDEEP 192:nxH6gVU1Bud//K1uwuyYaIlmaLwvLifWoYkG4rFyD4:nd6gm1Bud//KeQv+fWorx
TLSH
T1C1259C2677F22E78FDDCD9BA7B82D1761A037C7206C2011622DE775705618F8AAF162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 9e0429155152888f9864a61f48c5f5f4f7da6095ab79afd71a803a59ed5478cd
MD5 bbe70a516ccc8b65668330f36fc864a1
SHA1 64d22473429d43f2efdedb04d2b7e21cdee5a8f5
SHA512 916d965c0ed403058d03462d20cc7a657986a9d262cf3aa47034da8909ecf41e481d52bc4241516c114dec6d2d43ae50d4765b098373e6749ff47b7b319f2f5e
SSDEEP 3:tn4lblFnl9TGQmRC/Ld//mTZmPRJ/AaRd//cFO/HRZSRd//:aBBGQoC/LdXm85JxdXcFO/xZ0dX
TLSH
T1B0E192033082CE42DD0D2A709E9CC0D84A08BF008C20834B34C1F36F0BF35C01030004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 33c97d5c463286615c8824e84db5ae54644cbbbf37199ef465af98ee961aad60
MD5 724ca9e46d31c55844665921f39a6a76
SHA1 49855e22e89f4e7116928b8b1e099deabc15ed6c
SHA512 39e8c227a68918a67d4c1b7bb95f81e7386cd7f634c2269e1a9c4f44952312eb32d1ddbb52dcbafd65006e2505d84c913fc4d40f182d8eedb78b5bd1ef637df0
SSDEEP 3:tn4lQlF:aw
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Desktop\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

acpi.PNF

Path C:\Windows\INF\acpi.PNF
Size 10KB
SHA256 b5b3cb38233feaf8cb8ca511a931c91f565e960454ad1d794fcfa90dec0b341c
MD5 f17f53758d00c7e452200ce71c2de3df
SHA1 8c1c951f47eb0132861b7d7a3619ef93af4cfe4b
SHA512 b6c0df90d4b442630e30cbf247c8462e0d45639347587d5270fa8ca84194260e0855803932abf0fc0a23ef28d0c0808423619cb8f2557cd3116bffa6fc1558a7
SSDEEP 192:jooEwwf2G3PWCILaFmdtqkHbLmFypzNVy1WH/IVQPu2Ut:j2wwfX3+C9QLmy5PH/Y72O
TLSH
T19522364577E58E14F0B65EB4ADF5A4E6983ABCA11D02CB0F2124734F1873AC4DBB1636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

basicdisplay.PNF

Path C:\Windows\INF\basicdisplay.PNF
Size 7KB
SHA256 96868c9c494f68d9821658262fead15be2b9a018d82f6cf7994780680e43dbe8
MD5 88cae2ad1c8f84d02cd7f3868a25f215
SHA1 72102f08c5a5a56d1b94a2f7bfbd161a1b165544
SHA512 c3f58e94750ba27726ead37aef4a7d804a0e42e8778ec64f156d4dd7fa1814395ae045c5b3e9c09602f4f04622a540253bdefb773fc112364efa74c453a61deb
SSDEEP 96:CxaQiWQ0EfCC2our/YdEg2HOObjUny12ti2PfvXHMR2kftOf2eLzzb3Jl9ONIR6Y:HIr6ExHt/UnziOMr8hZlIRO5ju1lbO
TLSH
T13CF1235577EA8E14F1B69DB46DF051EA487ABC925C12DB1F3254330E4833AC4DAB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

basicrender.PNF

Path C:\Windows\INF\basicrender.PNF
Size 7KB
SHA256 09f97ff86c2184c6b65084341abdd12274f7390169b5c9fb6b07305809ad21f7
MD5 c52af24d55c078295110949b22beb91d
SHA1 e813c3beed527904eb1a95123f2b203916b0c682
SHA512 836d2e1ac14407b835bc2d14a031aa61cb213636625e26fd669df26db9820205747b4626b4de1f4d114487fef7e659eec0ed094c180dc03f34df5b4c10485504
SSDEEP 192:fFwra9AMUIJlgIQNNHiVKzMU/N68QGw9SsgGYrG7Dz:N59AMUmlgIQNNHiVKzMU/N6rp9SsgBef
TLSH
T14FF1145137EA8F14F0B69E319CF051EA8876BC816C12DA5F2158374E0C73B94DBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdrom.PNF

Path C:\Windows\INF\cdrom.PNF
Size 11KB
SHA256 6ec3910279c2c8978c1ec59d4701dea9e21de6fd9be64b2b3bda3370d7b73819
MD5 5c1c5bede699a6cbc64073dc8cb6ed7f
SHA1 7a87bbbd9341b4135b67c78bb3672effd3a3b215
SHA512 adc38e44328420d40a715eae418e8da75eba797f374f5586a0e66666f9b78f0375961ca2ec4b52051609d77394ff72cf258c0401b5aead39b3b5ba9ff8ca3c78
SSDEEP 192:JxozlJT/TiKqnYPcIvaTNaBo7c/NonZin9E4QkTA/zTtWWRMWaqKk8OskWuNo6wg:noRJT/TiKjPcIvaTNaBoA/+89dQyazTV
TLSH
T1E532444573ED8E05F2B29A70ADF465E6447ABCD25D12DA0FA120330E1C73B84DAB173A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compositebus.PNF

Path C:\Windows\INF\compositebus.PNF
Size 7KB
SHA256 b6f9f0f2cc384c565be26159a1e20816e316a65eae641a109eb22c7923a2aadc
MD5 31d3c5e66afc97f34514ab1964d99b4a
SHA1 519d0118ebf0b492b22d7634443cfdbf72259489
SHA512 193dd1e4547998b18982f2148e204f5471b846bff2fc2c92684a557001c28287bab833dd521c36cccbf7ecd4babc3e859f273294e87ada0dbfa0149bed18533c
SSDEEP 192:xxEh3rbgLfRUm1bliL9P61UIbuULFthKyJ3V9+g7zqwqcZNs:xxgYLCL9twqUS
TLSH
T1CCF11E4673E88F14F5B24D749EB251F5887BBCA25C25D71F21A8735E1C72A80CBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

display.PNF

Path C:\Windows\INF\display.PNF
Size 7KB
SHA256 55f9ed80110a9ccbac8e356c4ad9261d802c97cf8d8de2d138f3a882394a8e72
MD5 54099e194a05f33ce70153e1e266e548
SHA1 895c80142cadc49e296383fb80c112c6143918c6
SHA512 4a13567d35556d0794fa7bd8d5ffee564627805cbc10ff24b432d6de985b9fd0fff347cf0a4f742c64c11a136fd64494e747adfb763b3f04f605df4621c81bf4
SSDEEP 96:YwiTJgUgXX0C7PdEg2HoeUgsRXN3YJCVcmkbefEefUWDcdd8S69aR:7i0j7FExHoeUgsz3LVcmkzeXc38R9aR
TLSH
T13FF1664577D98E18F0B68A74ADF465EB0476BCA22C01DF5F3218330E1973A85E7A073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hal.PNF

Path C:\Windows\INF\hal.PNF
Size 5KB
SHA256 f5b236cd48003ebefc8379454f8b9c4b9cd71445b7be2e1f67be13ca9cd18e55
MD5 f5902f92120a3171ca8acc06ef958503
SHA1 d34515dc19edf5891bed91156fcd2c098fd5c083
SHA512 5a8deac2bbfafe8c38ee85fb486229877cb7d75ac83b6269628d1dd28c41195ee5caa92a17e0a9ab39b64700cac424d3cde75e5be7b448c769a5aae1185c0436
SSDEEP 96:N6XFrkmxOJ0khE3/OYt+XWPLoUbRVOhhXdKG0q0kGy8ne:Q5kE/ZwW7bLOJKGRRIe
TLSH
T124B1965176E68E08F57A95706DF090EA9426FCD16C01CB4F3154730E1C73E809BA073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hdaudbus.PNF

Path C:\Windows\INF\hdaudbus.PNF
Size 9KB
SHA256 6c33be8ef4eb9e89c3a710f827bd987d050005a87828a7fdf030254e04da1f1c
MD5 1a6b6fa004840f20c3ab657cc68b0bf1
SHA1 f60088011491da0dc982ec832c6f14296b9fde70
SHA512 6ef2e6cf5d442ebcfd745c2e22981278987b4856adabf431911a41d48e9e9668dac71994e3e699380e4949c1953ae575a358b182d71f24e182d877b83d6cb7b6
SSDEEP 192:3ZQXoaeYl7HqmM1x2VNCQaoPjVDIfMnO9sU00q:3ZQXVeYl7HqmM1gMoZpOeUY
TLSH
T18022415573E98F08F1F24E709EF8A5E60866BD926C11C76F2168730E1D72F809AB0736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hdaudio.PNF

Path C:\Windows\INF\hdaudio.PNF
Size 104KB
SHA256 d7e40ce069005055360ef0516e5fce33e02702c0ad429f84c57fe668b292f122
MD5 8398ac0ce7cdfcd357de63e5835862b1
SHA1 5759b81c5af6ee1087b36823bc6f8627f7976be6
SHA512 c13f7d4b4f27eb05cfdf6b33f1e025dcbee80bb3def5c9c1b58e201d15b5f8ed5b21deb6b4da83c5c0daefa78e899290b377cb23235c8deb02470f5bc63bdc06
SSDEEP 3072:DPwOcavhASqYneOcaJZyKDCBKqqKboY3nPgEWE3:sfavhASqYneOcaJZyKDCBKqqKboY3T
TLSH
T12BB3396076EC6A0AF3F39BB85BB554D6482BBC925C11E25F20B4B68E1C71FC04E95732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

input.PNF

Path C:\Windows\INF\input.PNF
Size 140KB
SHA256 3d5c451f16b70cf1b3a03c7c07580bcb047b485e918f2c28f8deaedc30653237
MD5 baaab50bc1e7d7e5ebd92eb3d34939b2
SHA1 ebc0ccf0aa8013421240535cec339e09f7ef9a04
SHA512 c78ebc00010ec89b709f0532d57b2b861eef7c3004a013aae2f8883aafeeb972016c5fbb13f16a6dd620e07c5b79fea61dd300cb6ad7ebdf92a790b4392fda0e
SSDEEP 3072:qucf/ur9f3LwjttMUVoR3t+i5kMWRJe8NOOpi3r1:ytp21
TLSH
T19CE33651B1D81B1EF2F61E712BF552E388367CD2AD60A75D19A0B30E6DB0F80CDA1B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keyboard.PNF

Path C:\Windows\INF\keyboard.PNF
Size 109KB
SHA256 f44095edfb85d665c84edc9577bec5ddb19bdca623d6e26784012bdc23a64f97
MD5 43737d015bd898ca25dd2b76149f70e7
SHA1 3c4cedcd4698d10af25a54ed8f6deaacdd6f3a40
SHA512 fc8923b694719fdd1696888765c23c759fa389ca62bf881683259706c57baa9d9233517d01197149bba1bcec2b24ed5d08d0441b39615bd2d45f2775bd1eeca1
SSDEEP 3072:MKPGW9m5d0Eedpt33itI1YcXj1IhQb21ABFzp/9Cc:xGcge
TLSH
T121B3655176D91B2EF1F35A722AF152A788397CD16D60DB4E1860B34E5CF0F80CEA1B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

machine.PNF

Path C:\Windows\INF\machine.PNF
Size 151KB
SHA256 9fb1e53291f8c3f8fd0b644be873f9954ec9ad04247c91a8406f837bb51a7e01
MD5 22f434b765fcb5f9d08dc68e40665b8e
SHA1 a12236f18f5a33ced78cefc5fd4395a39e5ad2b9
SHA512 9815a3928fd5fa7797d2da8f9714986e60203a771cf9b9306a2ccad4c4df4938af8f9977c7654297ad71228777c2aa728b82f5909c7f7f0dcff12a775efb0a78
SSDEEP 3072:Pfk1xfUGl90F3/fRbjSJUKx97Zfl0vUy+Yk:WhZf2vU1Yk
TLSH
T182E3DD147AC88D1CF36365B0AFE2C2AF7919BCE4BE42D72E5484734F59B2E416E41239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mshdc.PNF

Path C:\Windows\INF\mshdc.PNF
Size 64KB
SHA256 f9a5d20f90f133a7b608d87137dd7d5553b970b6e0be17664b04c401ba6d77dd
MD5 e9dddf5a9af71d1e664fc477180ceaa9
SHA1 21b6ce7b8d4f6bc4a80c7fa23e5e02fd7dd0cadd
SHA512 b403174f4613f35ad9c54106eb74316d57bdc5b5565b53a4a610d2d5d8afb286c066e0ee74b88887473117d557759f04a7d71ff72293e57c29827aa86edcc44a
SSDEEP 768:4LuTmXT3dKSlsNkwRNxATmhWHKLVOOzla8MDgb05D:wUmXT35sdRNxhWHKBO4la8cD
TLSH
T19B53AD0436D84F1AF1F3A670AEF686AA5825BCD16E21D70F54A0731F0872FC5AEA1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msmouse.PNF

Path C:\Windows\INF\msmouse.PNF
Size 90KB
SHA256 3747c13f74f00aac4dc8d384f6e0c90973bb2dc7c1875c988d5f6a66a76c5589
MD5 0aa6a5f8ed4a7b5bed355aa0e1feeffb
SHA1 9ebdacbe91635ba261437c9ecdf7e95d27e325bc
SHA512 ec0b9452f27dbff3947d1e212e9d308f228a937efdcce3f870cfb6a9574075ce75491b1a79628c9c5f9e9d5021a206d74730a5bdb6b11af79baed20da88440f5
SSDEEP 1536:MBHfc4Y6B2zNctM0vmlAyoNN/twfIV4pd4n5Vr:oHfc4Y6B2zNctM0vmlJoNN/twfIVAKr
TLSH
T1D393445172ED5B1EF2F60A716AF152974826BCC19D21D70E19A0B30F6CB1F81CEA1B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mssmbios.PNF

Path C:\Windows\INF\mssmbios.PNF
Size 7KB
SHA256 51ec989c711eb28362ec0b8b412345cdda1a7cbda1995089bfc359c2f6744c82
MD5 c9a6a6bc9315a6f9a63ffa71e379d35e
SHA1 d5f98fa0066a8e388eda583f120d59837d66ce07
SHA512 f0ac7b9ae34029ea9b3ef14d602a579efdfd106f256cd37b9b07690f6e7feb70abb1f01b36c0750032799d17d15dc632b878b21fc6319663aed0243187ffbcf7
SSDEEP 192:Fb4f1u36IQ9T38zJEBaQUtvyRrrokGvQM:F0fsKIQJBaQUxGrru
TLSH
T193F1264177E98E14F0BA5DB0ACF4A5E98876BC919C16CB1F2125770F1833AC4DBB172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ndisvirtualbus.PNF

Path C:\Windows\INF\ndisvirtualbus.PNF
Size 6KB
SHA256 48e1a5fdde4276a798de279ae202583ceff79dae718d737d9c806b998f646ca5
MD5 d7a5323a51438e3fd60796c784b3314c
SHA1 c0b7be29e86730ac4cad6bb48b3af1616990281c
SHA512 eba0b4ee00b6eb9f9a60c0c761490b75be6f98f4c3ee59f66ef08135b1f3f2558d8cbb24fbf852dc831058dc7a728149eaff77be6d7e17217a60d6c04b9086ea
SSDEEP 48:kKD7P03nf1ycTuf2emv5yMGBMHnhARfxI27G00hkipdEJnqbGt3:5D7PWfQcTuf2ev0nh2xJ7G00hrA/t3
TLSH
T147D1155577D48B09F2F69EB16CF095E608A27C839C01CE9F21A4730D6C32E94DAF072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pci.PNF

Path C:\Windows\INF\pci.PNF
Size 22KB
SHA256 975ff671707eec9bf0ee3c104ead033d5426824e1c780267b897c023b8766d87
MD5 eb8ed337a3ccad90c0c0d904f817eb98
SHA1 f8713e73d00de3b4de7c39e5a8e29a1b20b61cd8
SHA512 7d1841cba0798b80e5be28d5bb1016660d16419a6a8e511e3de74455d9dbe866d0ea58b2b9feb3e65dfc2e521ad5b266a87becade73c34d82771b0b9efe45ed5
SSDEEP 384:JIwckpkESdsHAT8oMgMbgW3jjwfLHHHHHHHHHHHHHHD:JIw5kESdsHFoMDbgWHwjHHHHHHHHHHHj
TLSH
T198A2429177E68B2AF1F70A705EF061E68C6AFC955D11CB4F6025B34E1872EC48EB0726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdpbus.PNF

Path C:\Windows\INF\rdpbus.PNF
Size 7KB
SHA256 ca63a1247c25c3d3528d148f066429cfcf84bda2c1f2cc4db9762ce43eb3c7a5
MD5 8eb07de602494e1bfd0c3605b879cec9
SHA1 2d957fc9c6dd46d44411c05dcc2297fa4c250271
SHA512 bc05ef27cde6dfedc97218114fdcfc8c995c6fd662054afb1a84460e606280ad9a90e49bccfc5c338df51ed32cded5e9cc9d8fa8ce2db59ea890eda87d0bdfe0
SSDEEP 96:guONqP9V4uEm4joCNfkjV1AQiExfh9iyXISyRQbXkmi:5Kqum4joMcjY7yRpC
TLSH
T11EE1214173E98E15F0BA5DB05EF891E68825BCD19C12CB1F3124734F1872EC4EAF062A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sensorsalsdriver.PNF

Path C:\Windows\INF\sensorsalsdriver.PNF
Size 12KB
SHA256 926d1882ae87f1d2c95df19976eab133928119afb598a35c80c88c95ff40a0a3
MD5 00c6c290b52d8890c7ea402635317558
SHA1 097f473b2ba5b901c0219dd9fe8672c35b6b53b7
SHA512 191af6f80f4ee9629843b193e317f8ad48cd578ae9c4c9349dfec67dfc21e78075fb63608c92129a6cc05d784bb9a4befd2453cd0e09c88a8b76132a28959a4a
SSDEEP 192:tegsP6Duu7HYwc5cVwGuQKHWc2p2dFSGVhDYWw1IH:kggK/uQK2x0dLDYWw1IH
TLSH
T176423642B7EA8E24F0BA1E70ADF560D698757DE16C45DB1F2120330F1872AD4DBF1626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spaceport.PNF

Path C:\Windows\INF\spaceport.PNF
Size 7KB
SHA256 cef72dab56c5e537910d8ca149f346a89677a6f15e19ca7bb7f56c2a648638af
MD5 c93e15c2bdd74e4edbea12d008572891
SHA1 bae4b59c398e3c50087dd91a4c9bad9db9a61eb1
SHA512 b3925d83400e543f3eb9c363c155212609b9900d5028ec538635d1c7beaf697ff0834762f2f4c8107e9e93a433ea3b28029bb48c9b99a42a03a1a9baef918d19
SSDEEP 96:b7heV3RO7pMhf61uvqEnKOoqAQPfdGlq21RzzxIpN6T74wRWY5gptr+X:bYK4fmuhnrqz71xPpD5gptC
TLSH
T1E1E11F4573EA8A14F5B64A386DB4A6E5187ABD816C01CE4F3164730F1D32ED4DBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swenum.PNF

Path C:\Windows\INF\swenum.PNF
Size 7KB
SHA256 abc9f6f4e46ae5a486ecbf885530a58e8b855ee86782abbcae322ecfcbec0471
MD5 449463ceb471f3646e11b5b48c3fefca
SHA1 478d81077cc0958a406410d0f84c89ed19d2758e
SHA512 745a9000a63c2e9e8c92d58ba782b6da35893d106ec1c3d8bdb720858c162198824c90abb9e2ba2edc1f4dd05d23fbc0625db17c6060b8d23add8fbcd6040c2f
SSDEEP 96:bjI0jFWx69wzfvcCqy13wZ0RE+NA7shQvIw0Pk1UNRWo0yASBA:wDwyfvcCDTa+kshQvsNRUyAUA
TLSH
T1C8F1764573D98F19F2BA5E70ADB1A6E90466BC825C12CB5F3124730E1C72AC0DBB073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umbus.PNF

Path C:\Windows\INF\umbus.PNF
Size 9KB
SHA256 5ac5a372c73d78907ee38f38e2573c14ae098df10f4a092e01bf7cc86fad2f6a
MD5 4a450331f2f31d4bead658e8ce7b5c2f
SHA1 e8b47cb02560e9246ba738ec9e4798dd40561bfb
SHA512 05720fe2fd7e7b71272e9fa9ca8467a5b0c575c912a15815bed01f930f652ef636a4810ce5917a4bca1d097d3bb3f8e310455a953fe1672570fbacbf5c35aa02
SSDEEP 96:oT9HUJQGM76X1PGdNRQIEqqNdjtMduIz2uiGLDY16ODYfTd0PpxGIukHQkSrAAmn:IGM7PH+IUNtMKlQYqfvWrAo
TLSH
T10022C91577E48F25F2B14A7499F525E268627CC36C02DF4F6168730E2D72A81CEE1B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbport.PNF

Path C:\Windows\INF\usbport.PNF
Size 131KB
SHA256 45b2628dd524caf72948c1fc950293f1e1d46f7c0a0eabe8e04fee9d8864fc5f
MD5 22310075dcb0702183db0774f4004e9b
SHA1 2300c495b11c03adc257567c98a934fd29be625c
SHA512 766149667cad2e11e960a8876d31963dfbead3579b69eeeef5d5f2d21370d57d5c0db8203a9be1f2b8850661967b4bf5cfc1cfb7c137c3b455dcd745cb605636
SSDEEP 1536:E/rp8lEna0iL6wlj4NS1cl15hm9ots4vGAi7v7Z7u:E/lZatvo1588LvG8
TLSH
T1AAD3360433D44B0AF2B35A70BEF191966D25BCE26E30EB1D4574B30F19B2E85ADA1B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vdrvroot.PNF

Path C:\Windows\INF\vdrvroot.PNF
Size 7KB
SHA256 ea982a11efc3b2b0b537f302e1bdd5e1ad5bee6949394f21b2f685e01bf28226
MD5 3db16e4ab1dadbcfc98b6beb9e27abb6
SHA1 463a6517c4e2d7fb21362906890a39d3b778067f
SHA512 10b2eaf0f40a6057a5908d6d2b9d388c36e2c3c9bfb7095610768cf37ad791e102c0032d1a81ef6f0bba195bfb86d350e8ed71124436f39862e301d975b35c5d
SSDEEP 96:7ba+/Rken6NXTQXjD9eaGFpXq1UVZR5Pnrh0ahDKXNt975g032ZxKBmVu:fD/+DQzpeaGTjnPN0ahDK3t2Cau
TLSH
T173F1331173E98F14F1B669B45DF5A5E9843ABDA19C02DB4F2128730F1C32ED09AE172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vhdmp.PNF

Path C:\Windows\INF\vhdmp.PNF
Size 7KB
SHA256 c9b9756b96e0e226aff9fef289158af0b3af361bd988143cc7413091836c9a60
MD5 71eeb79838a4071db307b4d486519578
SHA1 5f5cd9303b2e5b3f50dbb26daed6c04038e7d7df
SHA512 1eaf89c537f3c31d404a34f7c9a25f0d0839826060ae8e35b858d8e5c34957e4ed12c7eddae9f73e2251a4b772bcd285a49714a94ede7feb7f9d4291eaaf4019
SSDEEP 96:btDENXKZYmcHu7NfxOp31+3rCN4kjupB3qb1AQ+7RV7hrohUHyOX6SyUfuY9y6Kv:bSwfYS3rM7juC2/L7VyOv4kJ3XW
TLSH
T1C6F1425173E9CE14F0B65AB09DF4A5E69436BCA25C02DB1F3528734E1C32AD49BA072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volmgr.PNF

Path C:\Windows\INF\volmgr.PNF
Size 8KB
SHA256 cc7c54dc94de42bccc2e61e67dfd73098931fa964e0b2da77b03dfc88399383d
MD5 b1d253b39189369ad27a0d2f41ee94a1
SHA1 209d196ec7364c3e505e2c20c941918ecc5378f8
SHA512 5fdde1c8a7b0e83ff9d03691e9ffb32c8da9e42fe94b3a51fae88ec42a291e8d136bb345eed595484f5d2e0aab7a806f4e11bfd412c66db9d1b607ea3fcba2fe
SSDEEP 96:PVxeoCjBgNfmHL9DCKyM9jsf01AQdJRVTtAltKzwhAZ1X30tyJcqPnIQxy0Y1lV2:wOfmrFCvyjobqLTwtuwhY1q+ZaU
TLSH
T19502349573EA9E18F1B699B06DF494E54836BE925C05CB0F3224730F5833AD09BA0727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volsnap.PNF

Path C:\Windows\INF\volsnap.PNF
Size 4KB
SHA256 9856606422ad3340ea0795067355ab6e8a1a68b79d9480e4e0cfc170c7871305
MD5 b8068a20c5da1e4e3f9ecd746769e77f
SHA1 108d7406b1b9b57375b2952e2827e8067471def8
SHA512 d0760ddbdf2473641dbb8114a8f479f4ea154ad898575066138dab1f7cfe1f83c865d0d82c7eb976f0736a9f530f3c57e8da2841a9bbca5489ae7cc2399b43cc
SSDEEP 96:mPcEeToVsVXFNGfJ3NKqS3Rr1hwoYNKJZimZsZ4tmAghZ1fjnnRGUC:m01VzGfJdKqS311rIKJZimZsZIsZhjR4
TLSH
T15AB14752B3F88B15F1B69AB42DF096E65576BC825C51CB0F2524730E1872E90DBB073B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume.PNF

Path C:\Windows\INF\volume.PNF
Size 6KB
SHA256 1240b03fba273fe0514575b763f72dc9676c24bf86c7b7ffd74b5aade96df525
MD5 219bcf9f5616c15c0316d1ed9da44028
SHA1 2176219eb607ee70b3de7c844348b416ae47534d
SHA512 448f8ce263d278e9d6611b663e4d60f96402667c6a913b7dd342f58cf28e62ff44ae2c5d6c659a3fdf31983d153a8cc1f75382b701bd0e68cdab776bbeba0089
SSDEEP 96:37GHi69OlDtmQD71BGKwN7RYBhvD37O62JYNpzLcuTeGtUBBu2vG:LvtmvKA7GBpD37O69tUB+
TLSH
T197D1655573F98E04F2B69A706DF165EA443ABD824C51DB4F3564730F0C72AC4ABF0A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvid.PNF

Path C:\Windows\INF\wvid.PNF
Size 8KB
SHA256 5f368bb68d9c9ff9933fe704cbca19eb984c05a1d7367c0c75d42b82bb29950a
MD5 e11e134084bf52b4acf02e79d2bd1cb6
SHA1 9a7112d839911df8016bb3b67473ab820b878245
SHA512 76c98b47288fecdb610526b99dd11ae65d348885e448e7298b33743cb039b376444b2e7db07ab0b83eb5d4cb5ff4d3509393612683b7c9676185f6a1473e4248
SSDEEP 96:a0OvKYGp1z+EQE8PCTE8mrfO7z1nx6YPVQprMXSMUBjDRr8uR7J1rx6rQN/bphhK:1L/TEfrf+XPVQprMXSM4jDRrPrIrQtrY
TLSH
T16B021055B7DA9F19F0F65A705DF192E60866BCC2AC11DB4F2164730E1C32FC49AB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads