Analysis

  • max time kernel
    70s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2023, 22:23

General

  • Target

    eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe

  • Size

    1.2MB

  • MD5

    16bcc3b7f32c41e7c7222bf37fe39fe6

  • SHA1

    a25bc5442c86bdeb0dec6583f0e80e241745fb73

  • SHA256

    eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0

  • SHA512

    f3e7087f569b3bcc201c006c5dfcea6cf560cad480bc03e6f17790190bc35bf6659e91a9f91219952bd139a3c9afde961032ee1d0861158409206feaa6540f9e

  • SSDEEP

    24576:uj/6CtkHRos9l+zan4Q6eQqF5ZgQibE2zkMiJHic9OuTw258tox6T9G0SKoRl:A/NtkHRos9l+zan4QTB/2zkPtBq2itoP

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note
Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Signatures

  • LockerGoga

    LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
    "C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
      2⤵
      • Suspicious behavior: RenamesItself
      PID:2196
    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -m
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3508
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3896
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1628
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4440
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4668
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1864
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4152
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2288
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4172
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4504
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:1084
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4520
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        PID:3556
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4220
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4888
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4752
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
        • Drops file in Program Files directory
        PID:4828
      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
        3⤵
          PID:4436
        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
          3⤵
            PID:4256
          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
            3⤵
              PID:4708
            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
              3⤵
                PID:4908
              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                3⤵
                  PID:4232
                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                  3⤵
                    PID:2660
                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                    3⤵
                      PID:212
                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                      3⤵
                        PID:220
                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                        3⤵
                          PID:3112
                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                          3⤵
                            PID:3172
                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                            3⤵
                              PID:1852
                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                              3⤵
                                PID:3708
                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                3⤵
                                  PID:4792
                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                  3⤵
                                    PID:912
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 844
                                      4⤵
                                      • Program crash
                                      PID:4704
                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                    3⤵
                                      PID:4988
                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                      3⤵
                                        PID:1984
                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                        3⤵
                                          PID:628
                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                          3⤵
                                            PID:1612
                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                            3⤵
                                              PID:2116
                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                              3⤵
                                                PID:3208
                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                3⤵
                                                  PID:2760
                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                  3⤵
                                                    PID:3024
                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                    3⤵
                                                      PID:400
                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                      3⤵
                                                        PID:4500
                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                        3⤵
                                                        • Modifies extensions of user files
                                                        PID:3720
                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                        3⤵
                                                          PID:3772
                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                          3⤵
                                                            PID:2736
                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                            3⤵
                                                              PID:4056
                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                              3⤵
                                                                PID:2064
                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                3⤵
                                                                • Modifies extensions of user files
                                                                PID:692
                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                3⤵
                                                                  PID:2744
                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                  3⤵
                                                                  • Modifies extensions of user files
                                                                  PID:1292
                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                  3⤵
                                                                    PID:2772
                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                    3⤵
                                                                      PID:4872
                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                      3⤵
                                                                        PID:4808
                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                        3⤵
                                                                        • Modifies extensions of user files
                                                                        PID:3896
                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                        3⤵
                                                                          PID:4772
                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                          3⤵
                                                                            PID:2644
                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                            3⤵
                                                                              PID:3288
                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                              3⤵
                                                                                PID:4800
                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                3⤵
                                                                                  PID:4928
                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                  3⤵
                                                                                    PID:1472
                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                    3⤵
                                                                                      PID:772
                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                      3⤵
                                                                                        PID:4052
                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                        3⤵
                                                                                          PID:4504
                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                          3⤵
                                                                                            PID:1028
                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                            3⤵
                                                                                              PID:1584
                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                              3⤵
                                                                                                PID:3556
                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                3⤵
                                                                                                  PID:2080
                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                  3⤵
                                                                                                    PID:4732
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                    3⤵
                                                                                                      PID:4432
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                      3⤵
                                                                                                        PID:3616
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                        3⤵
                                                                                                          PID:1084
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                          3⤵
                                                                                                            PID:4456
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                            3⤵
                                                                                                              PID:3528
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                              3⤵
                                                                                                                PID:4128
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                3⤵
                                                                                                                  PID:4120
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                  3⤵
                                                                                                                    PID:1948
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                    3⤵
                                                                                                                      PID:1460
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                      3⤵
                                                                                                                        PID:4888
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                        3⤵
                                                                                                                          PID:1168
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                          3⤵
                                                                                                                            PID:1108
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                            3⤵
                                                                                                                              PID:4256
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                              3⤵
                                                                                                                                PID:4840
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                3⤵
                                                                                                                                  PID:724
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                  3⤵
                                                                                                                                    PID:4708
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                    3⤵
                                                                                                                                      PID:5088
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                      3⤵
                                                                                                                                        PID:2112
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                        3⤵
                                                                                                                                          PID:740
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                          3⤵
                                                                                                                                            PID:3020
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                            3⤵
                                                                                                                                              PID:3324
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                              3⤵
                                                                                                                                                PID:3472
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                3⤵
                                                                                                                                                  PID:112
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2780
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                    3⤵
                                                                                                                                                      PID:648
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3952
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3172
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 704
                                                                                                                                                            4⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:2004
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1608
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2280
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4988
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2088
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2104
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4508
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3600
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3124
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3188
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3152
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4912
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3484
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:316
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3208
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:984
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:632
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2760
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4252
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3024
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1844
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1304
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3604
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2728
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4756
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1396
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4308
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4092
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2064
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2108
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yxugwjud7677.exe -i Global\SM-yxugwjud -s
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 408 -p 2688 -ip 2688
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2688 -s 1016
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                        PID:3640
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Modifies Installed Components in the registry
                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1920 -s 2324
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:2544
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1920 -s 2324
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:1188
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 912 -ip 912
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 512 -p 1920 -ip 1920
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:3240
                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 532 -p 1920 -ip 1920
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 524 -p 2376 -ip 2376
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:3560
                                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2376 -s 444
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:4908
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3172 -ip 3172
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:2492

                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  7c608af13cddd27f9820fe57d2ea8645

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6bbf83473153f200a54547b80309066233d3de76

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  61b76dd40f05f1ca331c8a0c0229e604b9dbf8b4b4b093949256e8c6b46949a1

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b8aa3f7142945a66ab39a3fc7ce1e771a828a62c3ee57b7c218f6cfb6073d29d36a26327e5de13d43c08dd614c2967aaf53004cb328844664642760a5498d37e

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  428B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0685949c584726206b9733e74959ff65

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  b0d00ade8423c4f876b5907b11647231925639c1

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  96a7b22e420adc36104c38009fb01cdf6f0f4d710ba1f233c3c5ea6bf4ac4b2c

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8fbc4b9a8cecc92cb3ae38f731c595f3872bbd5dce2648f9c5020e09dab9371081b67c5570064475e2f5ff4559687bf2227507f11beec2c1047570f29514b89a

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\Mu\TransparentAdvertisers

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  401B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  86561953037fa758920ea57c8cb5f354

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  65ba83df0496dc03b3b1023c4edb414c958fdb0e

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  23fd904cef3b75810c35f367feb08196b97be9b752d4b9ce2902319c02b91280

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  25ec22d8de9c1d607ac4caee379efb0eccb0cc9cfccac6f406cc4e73730db7e9455200eb986da849cd7937876fe277cbb9f997549b0154337757edc8f45bb349

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Trust Protection Lists\manifest.json

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  576B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  04e7c91fd693137759854683f79e0103

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  abe067368835dd7930b1f9ff977bfb0ad85daebf

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  4c6cd7242eb6e02dbff738ecc6724699886753aee5c56e85349cede34e823093

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  23065ec10f36271e19c3ed6891a8c29f2bc6ec5262b3337e6aba3e0477fa2d51210a77eefb126d466257b2b095b56c620b531ff3f9aaf2cfa4597d97ff04225d

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\resources.pak

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  20.2MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  ac33c762972c60c6be89eb8ead1f6841

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  b8d4d2bd7b3e9077395a0c61d86fc68948593367

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  9866ba963675436ecf61091764df80830ba8c4c0793bfe7e61af09e5ba455865

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  a3c6e3007334a1b3c90848470f720e3bc5ed165451b75ab980b393a9bf76bbe1af13d205f9771616b5f825c7394eb60cd86c3158647394a12d8e185de2f5e97f

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\resources.pak

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  20.2MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  e767de76002a73b10f73d965563a331d

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  63d27a5feb569cf78c578ac79022efa11769aa10

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  dd690617cd1660395bf5c338c72bc6e3cd40a966e6f490095e3c9a461083c90f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  87f82800fbcfc500af9d5a9e56c46a7387679b1439967ee39a762b843efa762f7cc4a5bd84d2d9a0da64f3c89b561ea4d2bc67474daadfbbccc6ef72e0580e94

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\resources.pak

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  20.2MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  e767de76002a73b10f73d965563a331d

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  63d27a5feb569cf78c578ac79022efa11769aa10

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  dd690617cd1660395bf5c338c72bc6e3cd40a966e6f490095e3c9a461083c90f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  87f82800fbcfc500af9d5a9e56c46a7387679b1439967ee39a762b843efa762f7cc4a5bd84d2d9a0da64f3c89b561ea4d2bc67474daadfbbccc6ef72e0580e94

                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\telclient.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.3MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  8bb3996c72bbdd60c152189e9d7aa5e9

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  840e6199ad0d8a7d7ca6177dc4b5e2d2a33167ef

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  82486a6df9cc723438d2f9174f8ffbbd1ddc5d5a7ae689dee4d1b2203b089461

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  be2cad23908f62da8101e30503a80eda1f57585d807dc9f961443f851d3f8a82a6bc2e4f396f3ce96a02e82399088bf09eaa4233d1840a57049e7aae3d2935be

                                                                                                                                                                                                                                                                • C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.locked

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  289KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  33ec85690d13fc55ceb204c65b691e68

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  16d5a73f43e88138fd3b0fafb577fa05cae34576

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  165b3a41587d2f1ba154b86b82cb6a926c30404c4467603dd5782a1b64bd012b

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  9ca684e417891d6bb4f86267053ed6bab993e7d1c54c1f9a745c91eaf05a580a9c3593fe87b1fe9048224ad53335524b40b9305e9befb30ce74508434fe5feeb

                                                                                                                                                                                                                                                                • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.locked

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  623KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  5a38fd2a86a7a491b86e0a5701cc97e6

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  77416e366cc60d8b31d72f9e9525c30e9acef6c2

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e5a2e5109ba4fe6eb1ddc3451e54d894c98774f0409b248925fc5426f324c9c6

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  bec7b4d2cfce82ea8d60acabe2c3aa65cf82b89975ad5adda79375270c87e9665258a53e7722449f7ee10af000d9feae5bb9f6b48ab3ab057ed32df67e41da8f

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\README_LOCKED.txt

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bf41f65f8a5b7c27752368238ea18595

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335