Overview

overview

10

Static

static

7a3880a428...f6.exe

windows7-x64

10

7a3880a428...f6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    100s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2022, 20:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7a3880a4289ed44b59cc6043819334572ef281d7c968173ad1b3feade70798f6.exe

  • Size

    70KB

  • MD5

    53d7f16c242c352a30f8ddef88916f2c

  • SHA1

    3c1d53646d6df6ab6030fa4f8e5448adc7eea85e

  • SHA256

    7a3880a4289ed44b59cc6043819334572ef281d7c968173ad1b3feade70798f6

  • SHA512

    7fcbad023cc9d876957a778c2106eceae30db64272b594ea8c09af85cebfc7f2b52dde1d0cefeb3712b536952d695c22cd0bd95e9345568f88a41b50f7ad2ab6

  • SSDEEP

    768:1iCHI1nffAkGisSQ6KRcJZOYoBudWaDyqzlL49FLdS5yA+jz+CE8+R5nOwekfZUW:1LHIlfH7Q6qRBwWa2qxQFZA+j6bWw+9

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 24 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 12 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 12 IoCs
    evasion
  • Windows security bypass 2 TTPs 36 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 24 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 41 IoCs
  • Windows security modification 2 TTPs 44 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 46 IoCs
  • Drops file in Windows directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a3880a4289ed44b59cc6043819334572ef281d7c968173ad1b3feade70798f6.exe
    "C:\Users\Admin\AppData\Local\Temp\7a3880a4289ed44b59cc6043819334572ef281d7c968173ad1b3feade70798f6.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies system executable filetype association
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Windows security modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:952
    • C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:588
    • C:\WINDOWS\SysWOW64\cmd.exe
      C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
      2⤵
        PID:520
      • C:\WINDOWS\SysWOW64\cmd.exe
        C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
        2⤵
          PID:1088
        • C:\WINDOWS\SysWOW64\cmd.exe
          C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
          2⤵
            PID:1164
          • C:\WINDOWS\SysWOW64\cmd.exe
            C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
            2⤵
              PID:1588
            • C:\WINDOWS\SysWOW64\cmd.exe
              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
              2⤵
                PID:1888
              • C:\WINDOWS\SysWOW64\cmd.exe
                C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                2⤵
                  PID:1892
                • C:\WINDOWS\SysWOW64\cmd.exe
                  C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                  2⤵
                    PID:760
                  • C:\WINDOWS\SysWOW64\cmd.exe
                    C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                    2⤵
                      PID:1640
                    • C:\WINDOWS\SysWOW64\cmd.exe
                      C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                      2⤵
                        PID:2012
                      • C:\WINDOWS\SysWOW64\cmd.exe
                        C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                        2⤵
                          PID:1144
                        • C:\WINDOWS\SysWOW64\cmd.exe
                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                          2⤵
                            PID:864
                          • C:\WINDOWS\SysWOW64\cmd.exe
                            C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                            2⤵
                              PID:1484
                            • C:\WINDOWS\SysWOW64\cmd.exe
                              C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                              2⤵
                                PID:1328
                              • C:\WINDOWS\SysWOW64\cmd.exe
                                C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                2⤵
                                  PID:1516
                                • C:\WINDOWS\SysWOW64\cmd.exe
                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                  2⤵
                                    PID:1376
                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                    2⤵
                                      PID:816
                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                      2⤵
                                        PID:1428
                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                        2⤵
                                          PID:1716
                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                          2⤵
                                            PID:896
                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                            2⤵
                                              PID:528
                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                              2⤵
                                                PID:1164
                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                2⤵
                                                  PID:1824
                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                  2⤵
                                                    PID:1288
                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                    2⤵
                                                      PID:468
                                                    • C:\Windows\Black Hole.exe
                                                      "C:\Windows\Black Hole.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies system executable filetype association
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Windows security bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Modifies Control Panel
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1232
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1628
                                                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                      "C:\Windows\system32\Lubang Hitam.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies system executable filetype association
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Windows security bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Modifies Control Panel
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:340
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:628
                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                        3⤵
                                                          PID:1548
                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                          3⤵
                                                            PID:1120
                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                            3⤵
                                                              PID:2024
                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                              3⤵
                                                                PID:1408
                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                3⤵
                                                                  PID:1660
                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                  3⤵
                                                                    PID:568
                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                    3⤵
                                                                      PID:328
                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                      3⤵
                                                                        PID:1376
                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                        3⤵
                                                                          PID:1964
                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                          3⤵
                                                                            PID:1716
                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                            3⤵
                                                                              PID:1148
                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                              3⤵
                                                                                PID:1212
                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                3⤵
                                                                                  PID:1588
                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                  3⤵
                                                                                    PID:696
                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                    3⤵
                                                                                      PID:1524
                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                      3⤵
                                                                                        PID:1044
                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                        3⤵
                                                                                          PID:1968
                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                          3⤵
                                                                                            PID:864
                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                            3⤵
                                                                                              PID:992
                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                              3⤵
                                                                                                PID:836
                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                3⤵
                                                                                                  PID:280
                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                  3⤵
                                                                                                    PID:1232
                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                    3⤵
                                                                                                      PID:1732
                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                      3⤵
                                                                                                        PID:1408
                                                                                                      • C:\Windows\Black Hole.exe
                                                                                                        "C:\Windows\Black Hole.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1780
                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                          4⤵
                                                                                                            PID:692
                                                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                          "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2028
                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                        2⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Modifies system executable filetype association
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                        • Windows security bypass
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Executes dropped EXE
                                                                                                        • Windows security modification
                                                                                                        • Adds Run key to start application
                                                                                                        • Modifies Control Panel
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • System policy modification
                                                                                                        PID:428
                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                          3⤵
                                                                                                            PID:1544
                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                            3⤵
                                                                                                              PID:1652
                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                              3⤵
                                                                                                                PID:1388
                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                3⤵
                                                                                                                  PID:1432
                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                  3⤵
                                                                                                                    PID:1536
                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                    3⤵
                                                                                                                      PID:1560
                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                      3⤵
                                                                                                                        PID:700
                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                        3⤵
                                                                                                                          PID:592
                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                          3⤵
                                                                                                                            PID:1484
                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                            3⤵
                                                                                                                              PID:328
                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                              3⤵
                                                                                                                                PID:1104
                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                3⤵
                                                                                                                                  PID:1144
                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                  3⤵
                                                                                                                                    PID:1556
                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                    3⤵
                                                                                                                                      PID:612
                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                      3⤵
                                                                                                                                        PID:1740
                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                        3⤵
                                                                                                                                          PID:1636
                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                          3⤵
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1544
                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                          3⤵
                                                                                                                                            PID:1256
                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                            3⤵
                                                                                                                                              PID:1824
                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                              3⤵
                                                                                                                                                PID:1680
                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                3⤵
                                                                                                                                                  PID:1232
                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1756
                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1940
                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1388
                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                      • Windows security bypass
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Windows security modification
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Modifies Control Panel
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:1632
                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                        3⤵
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:1660
                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1828
                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1120
                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1588
                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1040
                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:760
                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1616
                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1620
                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1496
                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1212
                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1356
                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1824
                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1736
                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:900
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1044
                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:520
                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:696
                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1072
                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1952
                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:692
                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1144
                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1680
                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:544
                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1788
                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                    • C:\Windows\Black Hole.exe
                                                                                                                                                                                                      "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                      • Windows security bypass
                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Windows security modification
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies Control Panel
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:588
                                                                                                                                                                                                        • C:\Windows\Black Hole.exe
                                                                                                                                                                                                          "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:428
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                          "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:2324
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:520
                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:2672
                                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:2892
                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:2936
                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2796
                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:1904
                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:3040
                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                        "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • Modifies Control Panel
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:1172
                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:1752
                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:1072
                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:708
                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:1288
                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:840
                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:896
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:864
                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:1484
                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1748
                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:1384
                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                                                                        • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:2216
                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:2472
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:1740
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:2572
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:2984
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2788
                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                    • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                    • Windows security bypass
                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                    • Windows security modification
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • Modifies Control Panel
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:832
                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1892
                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1376
                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1328
                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:784
                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:820
                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1688
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1536
                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:612
                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:1128
                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:520
                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1740
                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1384
                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:900
                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:532
                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:916
                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1432
                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:568
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:1464
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                        • Modifies Control Panel
                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                        PID:956
                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:1120
                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:2156
                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2596
                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2656
                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2836
                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2768
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:836
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Windows security bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                      • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies Control Panel
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:328
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:340
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:520
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies Control Panel
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "1690761724-1469743917-682055781-950851460-9756378916097686361650028871-382583382"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "1087491402-1843231215-12283105431132162125-449121108-727915909-203414712-1341753679"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-318980303-690711543-1548002630-1461767245-1491880854-1478373063-750571102212241303"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "507637428-20668867831775770145-884966397-1284018344-182112525-645888550-190028908"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "970555870-106973834677583782-18320337391026578636-1514951186-2016064098-740439068"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-160938077720916970964586637032123826277-19826734522171581201272884013233283742"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1555219578-1926363424-1964585052100116694-21404183935164230578690870661761506035"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-146118176205303682310849473501715280601-19611935731870774226-15046192441041299734"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-9028955861494959465-8565615431479128384953105450837151387-842044790-230080785"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "1258255486-1232522731318831203-1878191594683283134-20557466391791527794-1207956212"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-850466841-2092070744-1013926911-368898030-493374392-452657768-2093046321648741822"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "1651802847850493913780520282039752378-15511095561640120375-621866731340011699"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-78866558011915225881265623241-1768064869-1359829261-202655994367200376-1814757752"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-1186363103819227614-10727297671236728167766911073-12956502401111401572459666373"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "16624593851633651048-1944179061656860761-1829752901455539423-612099005-536546733"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "63058466-420261229-1135263958-17742170591905033291126712554-1497582166-222422656"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "823632327357399561-1241066363-1422902836274026715966999912-1464639672336464343"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "855082695506729497-1592046607-1324580883173988848-2043538539-974547699-8097250"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-647593683530272858-198485674036096947017991575313154677901554046346233469058"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "481284758-1712368052-12578954-261051152-1299444776410706301-822192441528341400"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2596

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                87bdcbbf4ea65949dd11b8c58e8d61a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03ea16212dd2ea45773593067b2838b85ee52492

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06c1b3df1b3017788f540a1302e8fa097ea61cd7367e32981b4da124c589734f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fe3061626051c9a4758243f5ca44514f7ed02ddad02304b49f939859174022a636363fe4eabd2a4960f19fe6e129c92d22a6859ae52e0f43bc3db85b3e8b1370

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f8ba0ad3c372324eedc91e5d3719fec5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                39aa009e0caa6cccabe8c4c99f073bb863eb7ab0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86112e1c368f2ac7f278af9820e604cea6dd6df47e441d4ead71963f8fd39a37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fcc133baf6fd2d2762d4ea99e7e1adc8c40416db73f5b1d23b9482186eeb5b2669a480b4aa67e1d8184c4b069f2647f3e1980d3c5e971da9f41cf5f5824a7e63

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190bd4851ad71ddd57803d9b6d7197cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06cdc71a93bdd18b41e7c64b759daae4093bcf59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03388efac53e6c0bd0039fdbb95e7c540ed67a6af0eceed205c51ce21cd9f99c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8ebc8a21745760d436d0d261ea1bae32eeb74457f11be44226276ff17e8ae11f2329cb85a1aac6f85edd511c88075389f290256d0a52555be5c1839f42ac2ffc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                30effec34a9f06465d12ca4820131a9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3d397551899a72cfff9e509218b5279bf3505507

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06073bc8aee0356247fef8071975d15772109b62cfd31e52cc43caa93270a216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                09763cf8fd6cdf4a1652c89aa8bce2a4531fb1ebef862edd366346cfa4dd5ef5238ca740752441a08afff159022443bc2cb661f9de45dde88317dd170480ddd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f8ba0ad3c372324eedc91e5d3719fec5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                39aa009e0caa6cccabe8c4c99f073bb863eb7ab0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86112e1c368f2ac7f278af9820e604cea6dd6df47e441d4ead71963f8fd39a37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fcc133baf6fd2d2762d4ea99e7e1adc8c40416db73f5b1d23b9482186eeb5b2669a480b4aa67e1d8184c4b069f2647f3e1980d3c5e971da9f41cf5f5824a7e63

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2cf1cae7c4074d2d32b8fe82ea874be7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f924c835917ac1b34b58bde55cdac483a4bfc300

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2c9804eee2ba4fde149c1f7e52e8173482436ae847cb90855ab1eb00a1521cb8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fdd1db0c79877720534656d0d08481c51859c69b83e7a1cedf0ab8694379b9ed6d04690b9f92afe9585db6c1dda5b4820f0395dbf8fee78e42d83a13406ab20e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c0b8bc65a05f41dceef78dc18659e16d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                54b89845905c2970a6dec8c14b130a9535af5f6d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8b01a0bba4888b2c89e8c064bc40982e861e5751941e396e64cfe911506f9a71

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8aa7fc6feb3958d19883e657d1877ad85e925adf36c8853f3025731f0eb47cc8695c471792826734b626f0cccd3514753aa39db7988e8bbb2c35fa4daa81302a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190bd4851ad71ddd57803d9b6d7197cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06cdc71a93bdd18b41e7c64b759daae4093bcf59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03388efac53e6c0bd0039fdbb95e7c540ed67a6af0eceed205c51ce21cd9f99c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8ebc8a21745760d436d0d261ea1bae32eeb74457f11be44226276ff17e8ae11f2329cb85a1aac6f85edd511c88075389f290256d0a52555be5c1839f42ac2ffc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                30effec34a9f06465d12ca4820131a9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3d397551899a72cfff9e509218b5279bf3505507

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06073bc8aee0356247fef8071975d15772109b62cfd31e52cc43caa93270a216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                09763cf8fd6cdf4a1652c89aa8bce2a4531fb1ebef862edd366346cfa4dd5ef5238ca740752441a08afff159022443bc2cb661f9de45dde88317dd170480ddd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                357bf8d23d63e91e2e790121bb2e1acf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                157b73796a8f63a183e695726658f2f962d51ed1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                939448f87a9176706c2ee50e663f2d9064e4360ec17fd449ec3ab18d6163099b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b6629ad85e9eb9755f1303d51fa3437cf09dc9dcfa498a6b9fbbc8a7a4fbf91077886e5239410c21e493dc117bd3073e5a843b139995dbd0a8a2631d5b45633a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                30effec34a9f06465d12ca4820131a9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3d397551899a72cfff9e509218b5279bf3505507

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06073bc8aee0356247fef8071975d15772109b62cfd31e52cc43caa93270a216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                09763cf8fd6cdf4a1652c89aa8bce2a4531fb1ebef862edd366346cfa4dd5ef5238ca740752441a08afff159022443bc2cb661f9de45dde88317dd170480ddd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4c919b4305ffd5fa45d8fd3bbf93f40f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dafde90855f575661804a3af969d3c4dbbb2140e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8783b0e171b8838e86fcd3e27480026bd9c65a9df6b33cb087fa20edffa3ef03

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                155cdaa9a5f74a7593646e45f09fa6b07e3ae11a874f41849d6865b6f6909a190a84d81a9378f6f5e2416e0896f1592d33f0bfd5dac53d6bd004136d4e93c3d9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f8ba0ad3c372324eedc91e5d3719fec5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                39aa009e0caa6cccabe8c4c99f073bb863eb7ab0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86112e1c368f2ac7f278af9820e604cea6dd6df47e441d4ead71963f8fd39a37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fcc133baf6fd2d2762d4ea99e7e1adc8c40416db73f5b1d23b9482186eeb5b2669a480b4aa67e1d8184c4b069f2647f3e1980d3c5e971da9f41cf5f5824a7e63

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                0da31cf2744a08c834d37ce51404a489

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                42ee25407cc26cd01dab00b5d5cab2b749dae985

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                44a784dca5a852908ba17a4b00e28477389f68a6b399c590a3bd902dc9dab888

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86dafa35463f31cdf01fcb2fa624a05bc4972d4f2abce3b51cd4b64d8cbd74eb0258d3f0f1df3894544af0f69d66482f3b31a5039f20a06a9a7fa0ea9dd2e20e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c85be4083e7c4eb257cd703f04564e09

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c6bf180d857ce342b18ab21ee107e82a4c6b455e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b46b71d3592e28fbfe83f0aeea19b24b73c84ff1db3fca8e431645d6a04354a4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                837ec038a9cbb50f55ae44caf21b40125620b16b5cedf1cb160725f8a33045094512c6c1bc780fc8d84c046e4abba89e9274b290737ec6a2dafbcf4e95c58ec2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c85be4083e7c4eb257cd703f04564e09

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c6bf180d857ce342b18ab21ee107e82a4c6b455e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b46b71d3592e28fbfe83f0aeea19b24b73c84ff1db3fca8e431645d6a04354a4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                837ec038a9cbb50f55ae44caf21b40125620b16b5cedf1cb160725f8a33045094512c6c1bc780fc8d84c046e4abba89e9274b290737ec6a2dafbcf4e95c58ec2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2cf1cae7c4074d2d32b8fe82ea874be7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f924c835917ac1b34b58bde55cdac483a4bfc300

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2c9804eee2ba4fde149c1f7e52e8173482436ae847cb90855ab1eb00a1521cb8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fdd1db0c79877720534656d0d08481c51859c69b83e7a1cedf0ab8694379b9ed6d04690b9f92afe9585db6c1dda5b4820f0395dbf8fee78e42d83a13406ab20e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f2be874800b168cab22998a47f870160

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                e2d3cc7c453130ab9cdd647084946a512133dabb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a9076d7e54dc01f3792c21f59d5d5adf32cc97ee3e68f266f2487f2dd603524d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                d46fcfaf77b207dbf51f3a965ac4e741e2d1e8d51b6fbe18e43275f397551be939e720556cd2171cb84eef4ea2c04efc10434ca64dee0166b9cb5cacddd5936a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\services.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                0007021a170538b3aa961310f0aae255

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3f10edf97b7153260e8237741154d7ac67e06f88

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ea6b395a7aa0f374bbf08491eb4db988c0e1601caf9b866bf9f13da6106ac3e0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f744d656d2734859522fb48560bbd7bd33e0489c247dada4a78ad4d42fbb20084695d1c7950fda517ff4a3bd69c8a5669f2fcd5b34469d82c502361eba4f10c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1293b8d4aacd5d8f022750e6e7ce0170

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3b13f0218c731c741bb8026997ec32c726a6e7f8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                80995e62d295429e267e6b580ef4fc95a41e5b86d30eb9f0d03c9c527b955bf1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                d2005f9518c82f8a46924f466e76c855d6aef07d4b167f87183837b280780211128808aed5eb4730ed39d6fc860e25ba7173bf5922643172e601e480dd1a9ea6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\Black Hole.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6635e047c242e6d64b2716d81095bf5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\Black Hole.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6635e047c242e6d64b2716d81095bf5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                e067dafcbe64a95f5045a281397732db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                e067dafcbe64a95f5045a281397732db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                90e05aaea564a51b9354797820a0f283

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                867a16d9d61c8195823a2d7f298e40d4b04ab651

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f9055bff65c1b05ad08b2ff262126b0426d65cb87bf5335f6c9ef1b4afd459c3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                59f7fa15796ae797a777e0a4fd89d90707e9f1576af9af5a91e86d45b9976d77a8df01e673244bae08e3fa1f1371fd315eb3e1444cca74a60d854b2cd2e661aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1e7d5a1cf5ee06b71f2cb554959e824

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                bf92882d96ca56421597ea068e2ac4409f82b180

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7f9a08ac7ab1fc60997459d746fd9ecbdb52cf9eee7fee05a5992aad811afcf4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c73c9e9bcba168e078f108e45402436d3354fc261d95f35ece782a04e9e83467dc3fcda121dda9b494be019911753a3df9935b3f0b5b45c2c83f4565867b28c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1e7d5a1cf5ee06b71f2cb554959e824

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                bf92882d96ca56421597ea068e2ac4409f82b180

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7f9a08ac7ab1fc60997459d746fd9ecbdb52cf9eee7fee05a5992aad811afcf4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c73c9e9bcba168e078f108e45402436d3354fc261d95f35ece782a04e9e83467dc3fcda121dda9b494be019911753a3df9935b3f0b5b45c2c83f4565867b28c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27a340e56a0510399716a9b30dcb79af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a1722ab20db2b14f6f9a0f8e4acc0a5c411b23db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03d037828d447521995ba834ca74251b40aaed4061d4f48f4c62f5babe33281f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5f2eaead96340b75e6e44a81e6baa86deab8e84af6829b75a6deff7ebf3f2a695b9c48c014d3bffc1a715b2d7c41d445056387b554526f00350bc3db7d561e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\MSVBVM60.DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                bdd2501f0cae479f4fbcb65bb032ea17

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10b20fca7543644d32ef93f21f52cfd938e0a49a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f908a9893fb45edb9e51b4529e05832023aeb8061b2b15586141712961c0e4f6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f4183d66422db86391fe99e895e24b800a64c48c1567169d42f8b13a448f724cb13baccb37abfc474a889bae8f4bf1ec7592d10c4444fe1ec3c5c81e559d9542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190bd4851ad71ddd57803d9b6d7197cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06cdc71a93bdd18b41e7c64b759daae4093bcf59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03388efac53e6c0bd0039fdbb95e7c540ed67a6af0eceed205c51ce21cd9f99c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8ebc8a21745760d436d0d261ea1bae32eeb74457f11be44226276ff17e8ae11f2329cb85a1aac6f85edd511c88075389f290256d0a52555be5c1839f42ac2ffc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                e537626ab9eee488f7533c860e86ac47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                483e2a2e3ed6dc23da2d435ae77f16bb626b1353

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2b1f71e67aa5e1685109096981c276e6894d5f40e99d374030d2c499d9b7ad59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                db989ea573a4be61ced3d4211d18d53bfd110cffcc65165e1ce6f731edc805c15709c03dbbfd882880e740349e1446658ad8195726f33a02ffe0d0475f6621e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190bd4851ad71ddd57803d9b6d7197cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06cdc71a93bdd18b41e7c64b759daae4093bcf59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03388efac53e6c0bd0039fdbb95e7c540ed67a6af0eceed205c51ce21cd9f99c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8ebc8a21745760d436d0d261ea1bae32eeb74457f11be44226276ff17e8ae11f2329cb85a1aac6f85edd511c88075389f290256d0a52555be5c1839f42ac2ffc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190bd4851ad71ddd57803d9b6d7197cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06cdc71a93bdd18b41e7c64b759daae4093bcf59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                03388efac53e6c0bd0039fdbb95e7c540ed67a6af0eceed205c51ce21cd9f99c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8ebc8a21745760d436d0d261ea1bae32eeb74457f11be44226276ff17e8ae11f2329cb85a1aac6f85edd511c88075389f290256d0a52555be5c1839f42ac2ffc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                30effec34a9f06465d12ca4820131a9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3d397551899a72cfff9e509218b5279bf3505507

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06073bc8aee0356247fef8071975d15772109b62cfd31e52cc43caa93270a216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                09763cf8fd6cdf4a1652c89aa8bce2a4531fb1ebef862edd366346cfa4dd5ef5238ca740752441a08afff159022443bc2cb661f9de45dde88317dd170480ddd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                30effec34a9f06465d12ca4820131a9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3d397551899a72cfff9e509218b5279bf3505507

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                06073bc8aee0356247fef8071975d15772109b62cfd31e52cc43caa93270a216

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                09763cf8fd6cdf4a1652c89aa8bce2a4531fb1ebef862edd366346cfa4dd5ef5238ca740752441a08afff159022443bc2cb661f9de45dde88317dd170480ddd2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f8ba0ad3c372324eedc91e5d3719fec5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                39aa009e0caa6cccabe8c4c99f073bb863eb7ab0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86112e1c368f2ac7f278af9820e604cea6dd6df47e441d4ead71963f8fd39a37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fcc133baf6fd2d2762d4ea99e7e1adc8c40416db73f5b1d23b9482186eeb5b2669a480b4aa67e1d8184c4b069f2647f3e1980d3c5e971da9f41cf5f5824a7e63

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f8ba0ad3c372324eedc91e5d3719fec5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                39aa009e0caa6cccabe8c4c99f073bb863eb7ab0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                86112e1c368f2ac7f278af9820e604cea6dd6df47e441d4ead71963f8fd39a37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fcc133baf6fd2d2762d4ea99e7e1adc8c40416db73f5b1d23b9482186eeb5b2669a480b4aa67e1d8184c4b069f2647f3e1980d3c5e971da9f41cf5f5824a7e63

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2cf1cae7c4074d2d32b8fe82ea874be7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f924c835917ac1b34b58bde55cdac483a4bfc300

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2c9804eee2ba4fde149c1f7e52e8173482436ae847cb90855ab1eb00a1521cb8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fdd1db0c79877720534656d0d08481c51859c69b83e7a1cedf0ab8694379b9ed6d04690b9f92afe9585db6c1dda5b4820f0395dbf8fee78e42d83a13406ab20e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2cf1cae7c4074d2d32b8fe82ea874be7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f924c835917ac1b34b58bde55cdac483a4bfc300

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2c9804eee2ba4fde149c1f7e52e8173482436ae847cb90855ab1eb00a1521cb8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                fdd1db0c79877720534656d0d08481c51859c69b83e7a1cedf0ab8694379b9ed6d04690b9f92afe9585db6c1dda5b4820f0395dbf8fee78e42d83a13406ab20e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e89ee6d11f183e32110c76e67b66e1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47016dcae36c13f4adb1ac12880036292be6243b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25b8000f5d23e69f1619537ac1a197e4f105d53568806683b6c2c394ae05f9dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4e126b2195f8edb78862af221e1d6dda6c620fbed5cf1467bac059ac8dacba3a45235598c67d190617fa941726790ab60c9cd2d979236018667b0eb698859d7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/328-290-0x0000000000530000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/328-282-0x0000000000530000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/328-293-0x0000000000530000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/328-279-0x0000000000530000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/328-254-0x0000000000530000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/328-223-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/340-150-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/340-169-0x0000000002C80000-0x0000000002CEC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/428-151-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/428-241-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/428-265-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/520-313-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-310-0x0000000002680000-0x00000000026EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-281-0x0000000002680000-0x00000000026EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-187-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-309-0x0000000002680000-0x00000000026EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-252-0x0000000002680000-0x00000000026EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-275-0x0000000002680000-0x00000000026EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/896-286-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/896-285-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/952-231-0x0000000001FD0000-0x000000000203C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/952-148-0x0000000001FD0000-0x000000000203C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/952-55-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/952-58-0x0000000075591000-0x0000000075593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/952-184-0x0000000001FD0000-0x000000000203C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/952-147-0x0000000001FD0000-0x000000000203C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/956-283-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1044-294-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-243-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-262-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-248-0x0000000002BA0000-0x0000000002C0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-249-0x0000000002BA0000-0x0000000002C0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-224-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-277-0x0000000002BA0000-0x0000000002C0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1232-90-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1356-299-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1356-292-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1384-295-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1384-280-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1608-261-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1608-242-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1620-232-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1620-291-0x0000000002630000-0x000000000269C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1632-221-0x00000000025C0000-0x000000000262C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1632-185-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1632-225-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1644-284-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1644-297-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1780-153-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1780-170-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-276-0x0000000002770000-0x00000000027DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-311-0x0000000002770000-0x00000000027DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-255-0x0000000002770000-0x00000000027DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-312-0x0000000002770000-0x00000000027DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-222-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-278-0x0000000002770000-0x00000000027DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2216-244-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2216-245-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2272-264-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2272-250-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-304-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2324-266-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2332-298-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-306-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-253-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download