Overview

overview

10

Static

static

18620797d0...94.exe

windows7-x64

10

18620797d0...94.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 00:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18620797d07d0b4f8ac7d5f576022bb81d1071435cf59457862ba4d9416b7894.exe

  • Size

    70KB

  • MD5

    082e0cdca69b16bf2b2493553413877d

  • SHA1

    515d8c5db16f8f9731b7442f1bc8be6590c13788

  • SHA256

    18620797d07d0b4f8ac7d5f576022bb81d1071435cf59457862ba4d9416b7894

  • SHA512

    b5dd89c21e1729b0b9a98311097f75277e46d67a6f7e0d0b022fdd9c54f3a8c23ea5466bcde2fa59ca00e76f2db3b333b4ed103b0e04475803ce59ee69bd8623

  • SSDEEP

    768:1iCHI1nffAkGisSQ6KRcJZOYoBudWaDyqzlL49FLdS5yA+jz+CEZ+R5nOwekfZUW:1LHIlfH7Q6qRBwWa2qxQFZA+j60Ww+9

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 18 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 9 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 9 IoCs
    evasion
  • Windows security bypass 2 TTPs 27 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 18 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 7 IoCs
  • Windows security modification 2 TTPs 36 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 63 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 53 IoCs
  • Drops file in Windows directory 48 IoCs
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\18620797d07d0b4f8ac7d5f576022bb81d1071435cf59457862ba4d9416b7894.exe
    "C:\Users\Admin\AppData\Local\Temp\18620797d07d0b4f8ac7d5f576022bb81d1071435cf59457862ba4d9416b7894.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies system executable filetype association
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Windows security modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4572
    • C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1776
    • C:\WINDOWS\SysWOW64\cmd.exe
      C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
      2⤵
        PID:4376
      • C:\WINDOWS\SysWOW64\cmd.exe
        C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
        2⤵
          PID:1620
        • C:\WINDOWS\SysWOW64\cmd.exe
          C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
          2⤵
            PID:4144
          • C:\WINDOWS\SysWOW64\cmd.exe
            C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
            2⤵
              PID:2408
            • C:\WINDOWS\SysWOW64\cmd.exe
              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
              2⤵
                PID:1756
              • C:\WINDOWS\SysWOW64\cmd.exe
                C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                2⤵
                  PID:4428
                • C:\WINDOWS\SysWOW64\cmd.exe
                  C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                  2⤵
                    PID:1176
                  • C:\WINDOWS\SysWOW64\cmd.exe
                    C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                    2⤵
                      PID:1500
                    • C:\WINDOWS\SysWOW64\cmd.exe
                      C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                      2⤵
                        PID:2352
                      • C:\WINDOWS\SysWOW64\cmd.exe
                        C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                        2⤵
                          PID:5004
                        • C:\WINDOWS\SysWOW64\cmd.exe
                          C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                          2⤵
                            PID:4388
                          • C:\WINDOWS\SysWOW64\cmd.exe
                            C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                            2⤵
                              PID:2292
                            • C:\WINDOWS\SysWOW64\cmd.exe
                              C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                              2⤵
                                PID:2376
                              • C:\WINDOWS\SysWOW64\cmd.exe
                                C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                2⤵
                                  PID:4164
                                • C:\WINDOWS\SysWOW64\cmd.exe
                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                  2⤵
                                    PID:2676
                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                    2⤵
                                      PID:4632
                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                      2⤵
                                        PID:4160
                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                        2⤵
                                          PID:2072
                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                          2⤵
                                            PID:3460
                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                            2⤵
                                              PID:2540
                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                              2⤵
                                                PID:316
                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                2⤵
                                                  PID:4232
                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                  2⤵
                                                    PID:1584
                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                    2⤵
                                                      PID:4712
                                                    • C:\Windows\Black Hole.exe
                                                      "C:\Windows\Black Hole.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies system executable filetype association
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Windows security bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Modifies Control Panel
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:4940
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4568
                                                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                      "C:\Windows\system32\Lubang Hitam.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies system executable filetype association
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Windows security bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Modifies Control Panel
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:5100
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3220
                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                        3⤵
                                                          PID:4168
                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                          3⤵
                                                            PID:3192
                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                            3⤵
                                                              PID:3724
                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                              3⤵
                                                                PID:392
                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                3⤵
                                                                  PID:1248
                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                  3⤵
                                                                    PID:4380
                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                    3⤵
                                                                      PID:1712
                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                      3⤵
                                                                        PID:1132
                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                        3⤵
                                                                          PID:2024
                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                          3⤵
                                                                            PID:2544
                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                            3⤵
                                                                              PID:4732
                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                              3⤵
                                                                                PID:4356
                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                3⤵
                                                                                  PID:4120
                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                  3⤵
                                                                                    PID:2980
                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                    3⤵
                                                                                      PID:3820
                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                      3⤵
                                                                                        PID:4656
                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                        3⤵
                                                                                          PID:4492
                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                          3⤵
                                                                                            PID:4184
                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                            3⤵
                                                                                              PID:2588
                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                              3⤵
                                                                                                PID:4460
                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                3⤵
                                                                                                  PID:2328
                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                  3⤵
                                                                                                    PID:536
                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                    3⤵
                                                                                                      PID:4944
                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                      3⤵
                                                                                                        PID:1768
                                                                                                      • C:\Windows\Black Hole.exe
                                                                                                        "C:\Windows\Black Hole.exe"
                                                                                                        3⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Modifies system executable filetype association
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                        • Windows security bypass
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Windows security modification
                                                                                                        • Adds Run key to start application
                                                                                                        • Enumerates connected drives
                                                                                                        • Drops file in System32 directory
                                                                                                        • Drops file in Windows directory
                                                                                                        • Modifies Control Panel
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • System policy modification
                                                                                                        PID:2700
                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                          4⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3812
                                                                                                        • C:\Windows\Black Hole.exe
                                                                                                          "C:\Windows\Black Hole.exe"
                                                                                                          4⤵
                                                                                                            PID:312
                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                              5⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2412
                                                                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                            "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4192
                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                              5⤵
                                                                                                                PID:3876
                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:5024
                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                5⤵
                                                                                                                  PID:5004
                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:3428
                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                  5⤵
                                                                                                                    PID:2360
                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1708
                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:1500
                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5096
                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                    5⤵
                                                                                                                      PID:3916
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        6⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:3136
                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                    4⤵
                                                                                                                      PID:3424
                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                        5⤵
                                                                                                                          PID:4976
                                                                                                                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                      "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4128
                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                        4⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:3372
                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                      3⤵
                                                                                                                        PID:1996
                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                          4⤵
                                                                                                                            PID:4852
                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                          3⤵
                                                                                                                            PID:3128
                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                              4⤵
                                                                                                                                PID:4316
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  5⤵
                                                                                                                                    PID:3388
                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:1792
                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                  4⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3540
                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3920
                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                  4⤵
                                                                                                                                    PID:4448
                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                  3⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:2064
                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                    4⤵
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3040
                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                2⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Modifies system executable filetype association
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                • Windows security bypass
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Windows security modification
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Modifies Control Panel
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                • System policy modification
                                                                                                                                PID:4420
                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                  3⤵
                                                                                                                                    PID:1828
                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                    3⤵
                                                                                                                                      PID:3388
                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                      3⤵
                                                                                                                                        PID:1720
                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                        3⤵
                                                                                                                                          PID:3452
                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                          3⤵
                                                                                                                                            PID:1856
                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                            3⤵
                                                                                                                                              PID:2376
                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                              3⤵
                                                                                                                                                PID:1604
                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                3⤵
                                                                                                                                                  PID:804
                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                  3⤵
                                                                                                                                                    PID:372
                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4804
                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                      3⤵
                                                                                                                                                        PID:552
                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3496
                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4796
                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                            3⤵
                                                                                                                                                              PID:640
                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4224
                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4292
                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2088
                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1088
                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3704
                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2020
                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3492
                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4632
                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1512
                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3108
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4800
                                                                                                                                                                                  • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                    "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1500
                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:2768
                                                                                                                                                                                    • C:\Windows\Black Hole.exe
                                                                                                                                                                                      "C:\Windows\Black Hole.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:2152
                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:116
                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:3104
                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:1176
                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:4836
                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:4680
                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:392
                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2540
                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:804
                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                PID:440
                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                              • Windows security bypass
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Windows security modification
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Modifies Control Panel
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                              PID:4004
                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:3724
                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3768
                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3208
                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4368
                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2360
                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1176
                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2160
                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3200
                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4980
                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4184
                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1500
                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2356
                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:3624
                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4148
                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:1860
                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:1284
                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:4048
                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:3044
                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                      • Windows security bypass
                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Windows security modification
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • Modifies Control Panel
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4164
                                                                                                                                                                                                                                                        • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                          "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:4520
                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1680
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4172
                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:944
                                                                                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:1148
                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:3688
                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3180
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:652
                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:2420
                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:2840
                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1676
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:392
                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:3832
                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1520
                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:3532
                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4100
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:4852
                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:3328
                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                PID:1996
                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                              • Windows security bypass
                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Windows security modification
                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • Modifies Control Panel
                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:552
                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:4440
                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:2088
                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:828
                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:380
                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3356
                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4884
                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                              PID:3104
                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3476
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                    PID:3732
                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:4464
                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1732
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                PID:4904
                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4940
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • Modifies Control Panel
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                PID:824
                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3108
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4320
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:3904
                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                            PID:312
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2760
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:372
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                        PID:804
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2160

                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            b0e0521bde0e8fbdbadd7bf08ed65b69

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            ad1620357ba1889f06e9444b20b1f21247b0d24e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            69d03b1809e87b2b41cf3a4e8af1771305bca1534249119f5a1a7cb2e90a1b9a

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            b71a9fe29e81c04e1b0cb8e657aaf20a28368cd04b2040289f24a26e66ad6c3c0df5aa546272e512fa79a4097f3af37d66daf112c79be40a39a7f1ce98ba25ac

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            2a9e5a737f18cdd8fceffbc1837ea8f1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            40b5259fd2c32336ff523f36c8df1cfd6e5d8477

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            e05c4fd423a3289a423f65bdcf015e82d609d152d8ef2a05d723c223a6bb6f65

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            b11278d362e1bda6e3e508459bd1f38bda0b86c8d9591ba2fba98b383571703359e769138b5497c76311e1d5c0e3758fef9784f0d0fc56fded755be37d9ecf6f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            77784712a4b8dcb7e86a34ee08991e31

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a6fedbe911c7e754cfde0d6d11025c5cc78765f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            ff3021298a58cfa9fe713bb71517b3fe3f9adad35e348152f92ab28710b68751

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1d8f0e0d12e1d7cf2041fe1cf19359d7010fa68ceca975573840ada8575f7d92bb8bd116d18a300a22dea3876b3a07b4982006933a32960cd996bd80ff096019

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            61cc57a3a586f05921a822819bb1c95a

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            2e2b9b9ae927eeff58291eeb2b2aaa12dc559a58

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            1484879c8e4e915c1c32b7360d163063624cc58d84841fdf23e9bbcf650dc585

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            af1c2f7ca21a9d57d7cc6b0bb46a78bea146cc9a5b79b36d91d8ad195bfa67b63555aa579f26965ea24e0ee9a595632cc68a047277820812a0e9cbf8e11eea41

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            61cc57a3a586f05921a822819bb1c95a

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            2e2b9b9ae927eeff58291eeb2b2aaa12dc559a58

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            1484879c8e4e915c1c32b7360d163063624cc58d84841fdf23e9bbcf650dc585

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            af1c2f7ca21a9d57d7cc6b0bb46a78bea146cc9a5b79b36d91d8ad195bfa67b63555aa579f26965ea24e0ee9a595632cc68a047277820812a0e9cbf8e11eea41

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            77784712a4b8dcb7e86a34ee08991e31

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a6fedbe911c7e754cfde0d6d11025c5cc78765f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            ff3021298a58cfa9fe713bb71517b3fe3f9adad35e348152f92ab28710b68751

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1d8f0e0d12e1d7cf2041fe1cf19359d7010fa68ceca975573840ada8575f7d92bb8bd116d18a300a22dea3876b3a07b4982006933a32960cd996bd80ff096019

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            77784712a4b8dcb7e86a34ee08991e31

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a6fedbe911c7e754cfde0d6d11025c5cc78765f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            ff3021298a58cfa9fe713bb71517b3fe3f9adad35e348152f92ab28710b68751

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1d8f0e0d12e1d7cf2041fe1cf19359d7010fa68ceca975573840ada8575f7d92bb8bd116d18a300a22dea3876b3a07b4982006933a32960cd996bd80ff096019

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            84e4ef91446bd17de798bad4bc17bc77

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            fde605ed95d98fc6ebf826881a36e898f6ae1cee

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            a2189938e24f09483a73dac45e1f3c28fe99278319e2bac1ce75f514e1d340f6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2eb68daa2769cb679a91b38a5e7f000539887c611b971646d702f1c2e963d572b909531716590d41dd8809d068d8d72cad2bf5d4008601e44bf60a629f8e5529

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            9f0f1db6547be171a58760d72a8bff7e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            0d2ecea229e5ed03c4e0627a9bee8d5a493f00c4

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            1959002bcfa1d34290b51d9b1e6b3405038f277694062c3c4bd71d0fb13395a4

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            3b328f79433d3ff44fd437bbf2019e342cdb34f38b5250dc4b2719935571010e29a5491c0517355c33aacf8084c43f8a8751116f97a5ddc7caf6c8a39df47da6

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            37a905b7593c8577cffaf26cc9fbad0b

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            d670e3554905556d68b601c2d38a89a7497b0213

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            142e000399ed7a7360272a02f4dc190436d2ad494ce529b8ef6ec673538b6467

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            8b967cfc4007dded922ce986fa94ba68f55231f4e86c9a0943a816a24794747a749d3c5d96822741d326b385b25ff87ba6564bdc487096e24f6d9c0fd9f65789

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            3c980e4b227595cb9dee2879bd14e29c

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            53f3ea23d848baa152b738ba29b43065e8ae5e02

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            74db1b6d74147a14594fc67a294963ae846f9a9182ca5f73d924b2c59af8c88d

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            dfb116b8562a42fb3bd6168ecb20de8f8c4a14428afb9792a076c7ee57f1c2b7ba01ba6a71bf4adb7e7187cc19ead62a48083f61d796ad919950d1e1adfd0d2d

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            2805ef850df6ad18fe56da585a4bb550

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            6816a39b0d48f563ab5f6d37ee46717665b47ea8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            4c1b92fa99b9abdd4f557907b1757d1d9f682f206ba0a11d39dc00b0dbae9112

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            420fbc29462fb726d72dcaf7120c9d1fd4e6a066f17cc2852686644a58a30c88c2b3454cbcdf125bbd2d026da93a0c955423a62c0090200f609ab29632520997

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            77784712a4b8dcb7e86a34ee08991e31

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a6fedbe911c7e754cfde0d6d11025c5cc78765f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            ff3021298a58cfa9fe713bb71517b3fe3f9adad35e348152f92ab28710b68751

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1d8f0e0d12e1d7cf2041fe1cf19359d7010fa68ceca975573840ada8575f7d92bb8bd116d18a300a22dea3876b3a07b4982006933a32960cd996bd80ff096019

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            954f30d758fc2cd8a5b06ac363c5181c

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            2acfb954397ea57243c7950d9a8e64193cfe4a27

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            4b8332d2625bea77fa8b5d8542d4df21e2a8621193f08df37a2b137c9be2d4dd

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            cc0abc9ee74aa928ad06bf890fedcaaf039fe3fcb3f5f0d5733095cdf0687040eaaf7c0be40175afead29e0a0f27505637fac5d8ca2ab6b5e2ba25d5f654f0e9

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            68c5716d00ddc03eed9f281b7592ea9b

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            bd4061362cdcda2d2513b1aed198af52ed0a40ae

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            5316cb0db16e46c433cf271b77dee1d146a1b0eb0de6c27e1aedf32cfd8bc321

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            8130df4a3722f912dde35687046d10863fd8eedd48c80052d2c8494bdcc3e3f31e8bbb3f9a7d913787bf39c5de2c04c05d48f15526108d12ebde53767b96e2e4

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            84e4ef91446bd17de798bad4bc17bc77

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            fde605ed95d98fc6ebf826881a36e898f6ae1cee

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            a2189938e24f09483a73dac45e1f3c28fe99278319e2bac1ce75f514e1d340f6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2eb68daa2769cb679a91b38a5e7f000539887c611b971646d702f1c2e963d572b909531716590d41dd8809d068d8d72cad2bf5d4008601e44bf60a629f8e5529

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            8e54816c9798f80fd6bcbfe0666eeac8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a40ecdb29199ca6513006ea2789a0235e85697bc

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            6d429431fa5dea925e59834b8fce5e411dc5e0bf59bf0b3c14eeaae9f933ab20

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2d1865a7cb211bbaabd22ed7be4e1feeff23a1448b7072186edfea845337665feed7d2d1c8b025ce8d3502e2b68188854256be92e55999ca5261b97cc9643d85

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            5487d6d578a93ae7db71148875c7e5ba

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            22f2f1c44c45858189548132b1c84e209a1bfa74

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            19e3e7f3e603f025ac986c48b8e47ce5f607239578c3999b7edafa2f699744d6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            141ac62c6a9037a7679a85f3e89ba1029feb3ff2eb00719f54cdcf0c2fa6d7f3fc6aee784e69361a4e83a6ddbf9b34912819afc9c6625dc96f090c63cf8b6e20

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            192eaf65ed0da7f012bf13a98e83a072

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            e263a7733c748f0b91a173db654658dd8634c340

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            b81c8390af0eb7a039de1b00b9c6c3e9395f4fcfe8944569e2fa292bb7dcc704

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            4f080f678e9fb0bedb36b624f700127f7af70e1538f2129c4131dab12796f6281fe380264602b829e1be989381c61b8413d37ad13f92d9af60b5f480c867bb82

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            192eaf65ed0da7f012bf13a98e83a072

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            e263a7733c748f0b91a173db654658dd8634c340

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            b81c8390af0eb7a039de1b00b9c6c3e9395f4fcfe8944569e2fa292bb7dcc704

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            4f080f678e9fb0bedb36b624f700127f7af70e1538f2129c4131dab12796f6281fe380264602b829e1be989381c61b8413d37ad13f92d9af60b5f480c867bb82

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\Black Hole.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            6635e047c242e6d64b2716d81095bf5f

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\Black Hole.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            6635e047c242e6d64b2716d81095bf5f

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            e067dafcbe64a95f5045a281397732db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            e067dafcbe64a95f5045a281397732db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            b0e90677abf87cd9c9715f9a2aa37865

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            478e9034aaf22d738014711aa9d118f5926574d7

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            3bb56e59932511d8620c1b7dc497cd3f1c4ca7a1692114510874b7ac335adca6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            51878e85099a0b9c0a1ac4e1dddd50c9a75622f4b098664af2cf0ea520f8eaeb2c8fd92d7a49c55f95cf0808388b19b3e2931468a7b5d8068b639d4340300418

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            b0e90677abf87cd9c9715f9a2aa37865

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            478e9034aaf22d738014711aa9d118f5926574d7

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            3bb56e59932511d8620c1b7dc497cd3f1c4ca7a1692114510874b7ac335adca6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            51878e85099a0b9c0a1ac4e1dddd50c9a75622f4b098664af2cf0ea520f8eaeb2c8fd92d7a49c55f95cf0808388b19b3e2931468a7b5d8068b639d4340300418

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\MSVBVM60.DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            25f62c02619174b35851b0e0455b3d94

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            8e54816c9798f80fd6bcbfe0666eeac8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a40ecdb29199ca6513006ea2789a0235e85697bc

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            6d429431fa5dea925e59834b8fce5e411dc5e0bf59bf0b3c14eeaae9f933ab20

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2d1865a7cb211bbaabd22ed7be4e1feeff23a1448b7072186edfea845337665feed7d2d1c8b025ce8d3502e2b68188854256be92e55999ca5261b97cc9643d85

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            8e54816c9798f80fd6bcbfe0666eeac8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a40ecdb29199ca6513006ea2789a0235e85697bc

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            6d429431fa5dea925e59834b8fce5e411dc5e0bf59bf0b3c14eeaae9f933ab20

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2d1865a7cb211bbaabd22ed7be4e1feeff23a1448b7072186edfea845337665feed7d2d1c8b025ce8d3502e2b68188854256be92e55999ca5261b97cc9643d85

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            8e54816c9798f80fd6bcbfe0666eeac8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a40ecdb29199ca6513006ea2789a0235e85697bc

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            6d429431fa5dea925e59834b8fce5e411dc5e0bf59bf0b3c14eeaae9f933ab20

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2d1865a7cb211bbaabd22ed7be4e1feeff23a1448b7072186edfea845337665feed7d2d1c8b025ce8d3502e2b68188854256be92e55999ca5261b97cc9643d85

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            8e54816c9798f80fd6bcbfe0666eeac8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a40ecdb29199ca6513006ea2789a0235e85697bc

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            6d429431fa5dea925e59834b8fce5e411dc5e0bf59bf0b3c14eeaae9f933ab20

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            2d1865a7cb211bbaabd22ed7be4e1feeff23a1448b7072186edfea845337665feed7d2d1c8b025ce8d3502e2b68188854256be92e55999ca5261b97cc9643d85

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            e8f25788911790da521c98d628833fcd

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            fb2a82ebeed01d1c98f7db260aebde7f5dbd4b39

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            bb57134086568c7fc80bcedbf6254473eaa103d2da31d9d49267420d6cbe54a8

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            35fe561f174f5821464a8bb0208c01e2b65204668cd8f13d6c9c436ba5163bafc62f0de480f94e1762cb4d6a8e0ec8c1f844397baa9575b7151053bb2edd6cc6

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            fbfda3e7616b56b2d10d930c7bf8a9b6

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            833a33654e5fc64614fac29255f286c15aa3626e

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            83bc7d267aff07cb491bbb1e6940e48ce4ebad06410245e386347e6673627cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            872968c517ac37b233c3d5a1efb9083ff2983ec31ebf8059905671f1d1e62c707d072caa28eed4e2826e3a9f8177443f1b334fca27b11d84e64b19b0bf3fdf3f

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            63999b920528ea4de753acb3367c4dfe

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            4ffdd4be39ef94def7c7f2e2a8ff7169ac1fa792

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            88e30e9123b14f61757e52fe9a76f4d62cfc9945be28b45a94dd4245536c6af3

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            ec6a0b1487775bd9ec7edbd3b755007f990d7ddea6af5ea3906304d56be1f653fa4349a01894c4a5fe7c913d792daa765f8a804c7db91106138f82f5abe53c69

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            77784712a4b8dcb7e86a34ee08991e31

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            a6fedbe911c7e754cfde0d6d11025c5cc78765f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            ff3021298a58cfa9fe713bb71517b3fe3f9adad35e348152f92ab28710b68751

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            1d8f0e0d12e1d7cf2041fe1cf19359d7010fa68ceca975573840ada8575f7d92bb8bd116d18a300a22dea3876b3a07b4982006933a32960cd996bd80ff096019

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            75e3ed016b268b6fb0b66ff59e770a56

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            83ea56c3bec5a0c34c67dcea8b464ab5ac501ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            60778d0099ea53703cccb6dd31ad8ad8e1921d0a35585458fbd229631e2c25db

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            9a966d1f3ecaa2672ccdd754845aea3fe95faab05043096b586f6c0b4de271115fc1525f163d7324a6370f5c4efb936d6d55815e9e13e00065eb9f21e75a8203

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            3ba2592dc6fa694a57e92537ec37cebb

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            8a48033a2f2a03a26897d31de1b7b3b778dc6d85

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            07a11b9acb10a9a19fa8558e91122a520a5f30e050046f8f15133eecdd89f44f

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            c180967c22cf23d4f9b365d833caa3b1eb242e611986947f93d7be077112bb0f293a532f07b01fe56f144b48f75817577f5eaf2e494c1fa794511543cd4a805b

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            25f62c02619174b35851b0e0455b3d94

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                            25f62c02619174b35851b0e0455b3d94

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                            4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                            898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                            f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/116-315-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/312-351-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/552-411-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/552-409-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/640-333-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/824-288-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/824-431-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1132-326-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1132-324-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1176-318-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1500-306-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1500-312-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1680-342-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1708-384-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1792-292-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1996-269-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2064-305-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2064-311-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2152-304-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2448-410-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2556-430-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2556-273-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2700-251-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2700-428-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3128-285-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-399-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3212-356-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3424-396-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3428-374-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3696-367-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3732-404-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3768-420-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3904-391-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3904-390-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3920-299-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4004-426-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4004-225-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4048-361-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4128-260-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4148-341-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4192-359-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4280-385-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4316-347-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4420-425-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4420-212-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4448-381-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4468-239-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4468-427-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4520-334-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4572-132-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4572-429-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4680-325-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4680-322-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4904-423-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4940-171-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5024-370-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5100-424-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5100-189-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                            Download