Overview

overview

10

Static

static

eda26a1cd8...a0.exe

windows7-x64

10

eda26a1cd8...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    70s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2023, 22:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
  • Size 1.2MB
  • Sample230107-2a3elseh76
  • SHA256 eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockergogabankerpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note
  • Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Signatures

  • LockerGoga

    LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.

    trojanbankerlockergoga
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
    "C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
      2⤵
      • Suspicious behavior: RenamesItself
      PID:2196
    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -m
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3508
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3896
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1628
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4440
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4668
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1864
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4152
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2288
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4172
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4504
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:1084
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4520
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        PID:3556
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4220
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4888
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4752
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4828
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
          PID:4436
        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
          3⤵
            PID:4256
          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
            3⤵
              PID:4708
            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
              3⤵
                PID:4908
              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                3⤵
                  PID:4232
                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                  3⤵
                    PID:2660
                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                    3⤵
                      PID:212
                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                      3⤵
                        PID:220
                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                        3⤵
                          PID:3112
                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                          3⤵
                            PID:3172
                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                            3⤵
                              PID:1852
                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                              3⤵
                                PID:3708
                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                3⤵
                                  PID:4792
                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                  3⤵
                                    PID:912
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 844
                                      4⤵
                                      • Program crash
                                      PID:4704
                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                    3⤵
                                      PID:4988
                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                      3⤵
                                        PID:1984
                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                        3⤵
                                          PID:628
                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                          3⤵
                                            PID:1612
                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                            3⤵
                                              PID:2116
                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                              3⤵
                                                PID:3208
                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                3⤵
                                                  PID:2760
                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                  3⤵
                                                    PID:3024
                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                    3⤵
                                                      PID:400
                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                      3⤵
                                                        PID:4500
                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                        3⤵
                                                        • Modifies extensions of user files
                                                        PID:3720
                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                        3⤵
                                                          PID:3772
                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                          3⤵
                                                            PID:2736
                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                            3⤵
                                                              PID:4056
                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                              3⤵
                                                                PID:2064
                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                3⤵
                                                                • Modifies extensions of user files
                                                                PID:692
                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                3⤵
                                                                  PID:2744
                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                  3⤵
                                                                  • Modifies extensions of user files
                                                                  PID:1292
                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                  3⤵
                                                                    PID:2772
                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                    3⤵
                                                                      PID:4872
                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                      3⤵
                                                                        PID:4808
                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                        3⤵
                                                                        • Modifies extensions of user files
                                                                        PID:3896
                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                        3⤵
                                                                          PID:4772
                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                          3⤵
                                                                            PID:2644
                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                            3⤵
                                                                              PID:3288
                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                              3⤵
                                                                                PID:4800
                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                3⤵
                                                                                  PID:4928
                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                  3⤵
                                                                                    PID:1472
                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                    3⤵
                                                                                      PID:772
                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                      3⤵
                                                                                        PID:4052
                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                        3⤵
                                                                                          PID:4504
                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                          3⤵
                                                                                            PID:1028
                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                            3⤵
                                                                                              PID:1584
                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                              3⤵
                                                                                                PID:3556
                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                3⤵
                                                                                                  PID:2080
                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                  3⤵
                                                                                                    PID:4732
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                    3⤵
                                                                                                      PID:4432
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                      3⤵
                                                                                                        PID:3616
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                        3⤵
                                                                                                          PID:1084
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                          3⤵
                                                                                                            PID:4456
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                            3⤵
                                                                                                              PID:3528
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                              3⤵
                                                                                                                PID:4128
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                3⤵
                                                                                                                  PID:4120
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                  3⤵
                                                                                                                    PID:1948
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                    3⤵
                                                                                                                      PID:1460
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                      3⤵
                                                                                                                        PID:4888
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                        3⤵
                                                                                                                          PID:1168
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                          3⤵
                                                                                                                            PID:1108
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                            3⤵
                                                                                                                              PID:4256
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                              3⤵
                                                                                                                                PID:4840
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                3⤵
                                                                                                                                  PID:724
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                  3⤵
                                                                                                                                    PID:4708
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                    3⤵
                                                                                                                                      PID:5088
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                      3⤵
                                                                                                                                        PID:2112
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                        3⤵
                                                                                                                                          PID:740
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                          3⤵
                                                                                                                                            PID:3020
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                            3⤵
                                                                                                                                              PID:3324
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                              3⤵
                                                                                                                                                PID:3472
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                3⤵
                                                                                                                                                  PID:112
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2780
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                    3⤵
                                                                                                                                                      PID:648
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3952
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3172
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 704
                                                                                                                                                            4⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:2004
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1608
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2280
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4988
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2088
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2104
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4508
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3600
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3124
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3188
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3152
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4912
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3484
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:316
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3208
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:984
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:632
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2760
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4252
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3024
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1844
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1304
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3604
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2728
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4756
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1396
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4308
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4092
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2064
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2108
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 408 -p 2688 -ip 2688
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2688 -s 1016
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                        PID:3640
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Modifies Installed Components in the registry
                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1920 -s 2324
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:2544
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1920 -s 2324
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:1188
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 912 -ip 912
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 512 -p 1920 -ip 1920
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:3240
                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 532 -p 1920 -ip 1920
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 524 -p 2376 -ip 2376
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:3560
                                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2376 -s 444
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:4908
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3172 -ip 3172
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:2492

                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                      Staging.DATA
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA
                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                      • SHA256 61b76dd40f05f1ca331c8a0c0229e604b9dbf8b4b4b093949256e8c6b46949a1
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      manifest.json.DATA
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA
                                                                                                                                                                                                                                                                      • Size 428B
                                                                                                                                                                                                                                                                      • SHA256 96a7b22e420adc36104c38009fb01cdf6f0f4d710ba1f233c3c5ea6bf4ac4b2c
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      TransparentAdvertisers
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\Mu\TransparentAdvertisers
                                                                                                                                                                                                                                                                      • Size 401B
                                                                                                                                                                                                                                                                      • SHA256 23fd904cef3b75810c35f367feb08196b97be9b752d4b9ce2902319c02b91280
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\manifest.json
                                                                                                                                                                                                                                                                      • Size 576B
                                                                                                                                                                                                                                                                      • SHA256 4c6cd7242eb6e02dbff738ecc6724699886753aee5c56e85349cede34e823093
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      resources.pak
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\resources.pak
                                                                                                                                                                                                                                                                      • Size 20.2MB
                                                                                                                                                                                                                                                                      • SHA256 9866ba963675436ecf61091764df80830ba8c4c0793bfe7e61af09e5ba455865
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      resources.pak
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\resources.pak
                                                                                                                                                                                                                                                                      • Size 20.2MB
                                                                                                                                                                                                                                                                      • SHA256 dd690617cd1660395bf5c338c72bc6e3cd40a966e6f490095e3c9a461083c90f
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      resources.pak
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\resources.pak
                                                                                                                                                                                                                                                                      • Size 20.2MB
                                                                                                                                                                                                                                                                      • SHA256 dd690617cd1660395bf5c338c72bc6e3cd40a966e6f490095e3c9a461083c90f
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      telclient.dll
                                                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\telclient.dll
                                                                                                                                                                                                                                                                      • Size 2.3MB
                                                                                                                                                                                                                                                                      • SHA256 82486a6df9cc723438d2f9174f8ffbbd1ddc5d5a7ae689dee4d1b2203b089461
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.locked
                                                                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.locked
                                                                                                                                                                                                                                                                      • Size 289KB
                                                                                                                                                                                                                                                                      • SHA256 165b3a41587d2f1ba154b86b82cb6a926c30404c4467603dd5782a1b64bd012b
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.locked
                                                                                                                                                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.locked
                                                                                                                                                                                                                                                                      • Size 623KB
                                                                                                                                                                                                                                                                      • SHA256 e5a2e5109ba4fe6eb1ddc3451e54d894c98774f0409b248925fc5426f324c9c6
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                      README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Path C:\Users\Public\Desktop\README_LOCKED.txt
                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                      • SHA256 544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53
                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                      Submit Download