eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0

Analysis

max time kernel
67s
max time network
135s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/01/2023, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockerGoga ransomware.exe
Size

1.2MB
MD5

16bcc3b7f32c41e7c7222bf37fe39fe6
SHA1

a25bc5442c86bdeb0dec6583f0e80e241745fb73
SHA256

eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0
SHA512

f3e7087f569b3bcc201c006c5dfcea6cf560cad480bc03e6f17790190bc35bf6659e91a9f91219952bd139a3c9afde961032ee1d0861158409206feaa6540f9e
SSDEEP

24576:uj/6CtkHRos9l+zan4Q6eQqF5ZgQibE2zkMiJHic9OuTw258tox6T9G0SKoRl:A/NtkHRos9l+zan4QTB/2zkPtBq2itoP

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	yxugwjud581.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	yxugwjud581.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	yxugwjud581.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Journal\NBDoc.DLL	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\AddIns.store	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.htm	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpCom.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif	yxugwjud581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\flyout.css	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\abcpy.ini	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\PREVIEW.GIF	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OFFREL.DLL	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL	yxugwjud581.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\THMBNAIL.PNG	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\WATERMAR.ELM	yxugwjud581.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Journal\NBMapTIP.dll	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MSTAG.TLB	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF	yxugwjud581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml	yxugwjud581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\calendar.css	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\settings.js	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Mail\wabimp.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\settings.css	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml	yxugwjud581.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_windy.png	yxugwjud581.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Defender\MpRTP.dll	yxugwjud581.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png	yxugwjud581.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1244	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1984	yxugwjud581.exe
1984	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1712	yxugwjud581.exe
1712	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1336	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1764	yxugwjud581.exe
1116	yxugwjud581.exe
1116	yxugwjud581.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1544	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	LockerGoga ransomware.exe
Token: SeBackupPrivilege	1588	LockerGoga ransomware.exe
Token: SeRestorePrivilege	1588	LockerGoga ransomware.exe
Token: SeLockMemoryPrivilege	1588	LockerGoga ransomware.exe
Token: SeCreateGlobalPrivilege	1588	LockerGoga ransomware.exe
Token: SeDebugPrivilege	1600	yxugwjud581.exe
Token: SeBackupPrivilege	1600	yxugwjud581.exe
Token: SeRestorePrivilege	1600	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1600	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1600	yxugwjud581.exe
Token: SeDebugPrivilege	1336	yxugwjud581.exe
Token: SeDebugPrivilege	1712	yxugwjud581.exe
Token: SeBackupPrivilege	1336	yxugwjud581.exe
Token: SeBackupPrivilege	1712	yxugwjud581.exe
Token: SeRestorePrivilege	1336	yxugwjud581.exe
Token: SeRestorePrivilege	1712	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1336	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1712	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1336	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1712	yxugwjud581.exe
Token: SeDebugPrivilege	1984	yxugwjud581.exe
Token: SeBackupPrivilege	1984	yxugwjud581.exe
Token: SeRestorePrivilege	1984	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1984	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1984	yxugwjud581.exe
Token: SeDebugPrivilege	1764	yxugwjud581.exe
Token: SeBackupPrivilege	1764	yxugwjud581.exe
Token: SeRestorePrivilege	1764	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1764	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1764	yxugwjud581.exe
Token: SeDebugPrivilege	1116	yxugwjud581.exe
Token: SeBackupPrivilege	1116	yxugwjud581.exe
Token: SeRestorePrivilege	1116	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1116	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1116	yxugwjud581.exe
Token: SeDebugPrivilege	1996	yxugwjud581.exe
Token: SeBackupPrivilege	1996	yxugwjud581.exe
Token: SeRestorePrivilege	1996	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1996	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1996	yxugwjud581.exe
Token: SeDebugPrivilege	1616	yxugwjud581.exe
Token: SeBackupPrivilege	1616	yxugwjud581.exe
Token: SeRestorePrivilege	1616	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1616	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1616	yxugwjud581.exe
Token: SeDebugPrivilege	600	yxugwjud581.exe
Token: SeBackupPrivilege	600	yxugwjud581.exe
Token: SeRestorePrivilege	600	yxugwjud581.exe
Token: SeLockMemoryPrivilege	600	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	600	yxugwjud581.exe
Token: SeDebugPrivilege	1812	yxugwjud581.exe
Token: SeBackupPrivilege	1812	yxugwjud581.exe
Token: SeRestorePrivilege	1812	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1812	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	1812	yxugwjud581.exe
Token: SeDebugPrivilege	316	yxugwjud581.exe
Token: SeBackupPrivilege	316	yxugwjud581.exe
Token: SeRestorePrivilege	316	yxugwjud581.exe
Token: SeLockMemoryPrivilege	316	yxugwjud581.exe
Token: SeCreateGlobalPrivilege	316	yxugwjud581.exe
Token: SeDebugPrivilege	1736	yxugwjud581.exe
Token: SeBackupPrivilege	1736	yxugwjud581.exe
Token: SeRestorePrivilege	1736	yxugwjud581.exe
Token: SeLockMemoryPrivilege	1736	yxugwjud581.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1544	1588	LockerGoga ransomware.exe	28
PID 1588 wrote to memory of 1544	1588	LockerGoga ransomware.exe	28
PID 1588 wrote to memory of 1544	1588	LockerGoga ransomware.exe	28
PID 1588 wrote to memory of 1544	1588	LockerGoga ransomware.exe	28
PID 1588 wrote to memory of 1600	1588	LockerGoga ransomware.exe	30
PID 1588 wrote to memory of 1600	1588	LockerGoga ransomware.exe	30
PID 1588 wrote to memory of 1600	1588	LockerGoga ransomware.exe	30
PID 1588 wrote to memory of 1600	1588	LockerGoga ransomware.exe	30
PID 1600 wrote to memory of 1336	1600	yxugwjud581.exe	34
PID 1600 wrote to memory of 1336	1600	yxugwjud581.exe	34
PID 1600 wrote to memory of 1336	1600	yxugwjud581.exe	34
PID 1600 wrote to memory of 1336	1600	yxugwjud581.exe	34
PID 1600 wrote to memory of 1984	1600	yxugwjud581.exe	33
PID 1600 wrote to memory of 1984	1600	yxugwjud581.exe	33
PID 1600 wrote to memory of 1984	1600	yxugwjud581.exe	33
PID 1600 wrote to memory of 1984	1600	yxugwjud581.exe	33
PID 1600 wrote to memory of 1712	1600	yxugwjud581.exe	32
PID 1600 wrote to memory of 1712	1600	yxugwjud581.exe	32
PID 1600 wrote to memory of 1712	1600	yxugwjud581.exe	32
PID 1600 wrote to memory of 1712	1600	yxugwjud581.exe	32
PID 1600 wrote to memory of 1764	1600	yxugwjud581.exe	31
PID 1600 wrote to memory of 1764	1600	yxugwjud581.exe	31
PID 1600 wrote to memory of 1764	1600	yxugwjud581.exe	31
PID 1600 wrote to memory of 1764	1600	yxugwjud581.exe	31
PID 1600 wrote to memory of 1116	1600	yxugwjud581.exe	36
PID 1600 wrote to memory of 1116	1600	yxugwjud581.exe	36
PID 1600 wrote to memory of 1116	1600	yxugwjud581.exe	36
PID 1600 wrote to memory of 1116	1600	yxugwjud581.exe	36
PID 1600 wrote to memory of 1996	1600	yxugwjud581.exe	37
PID 1600 wrote to memory of 1996	1600	yxugwjud581.exe	37
PID 1600 wrote to memory of 1996	1600	yxugwjud581.exe	37
PID 1600 wrote to memory of 1996	1600	yxugwjud581.exe	37
PID 1600 wrote to memory of 1616	1600	yxugwjud581.exe	38
PID 1600 wrote to memory of 1616	1600	yxugwjud581.exe	38
PID 1600 wrote to memory of 1616	1600	yxugwjud581.exe	38
PID 1600 wrote to memory of 1616	1600	yxugwjud581.exe	38
PID 1600 wrote to memory of 600	1600	yxugwjud581.exe	39
PID 1600 wrote to memory of 600	1600	yxugwjud581.exe	39
PID 1600 wrote to memory of 600	1600	yxugwjud581.exe	39
PID 1600 wrote to memory of 600	1600	yxugwjud581.exe	39
PID 1600 wrote to memory of 1812	1600	yxugwjud581.exe	41
PID 1600 wrote to memory of 1812	1600	yxugwjud581.exe	41
PID 1600 wrote to memory of 1812	1600	yxugwjud581.exe	41
PID 1600 wrote to memory of 1812	1600	yxugwjud581.exe	41
PID 1600 wrote to memory of 1736	1600	yxugwjud581.exe	42
PID 1600 wrote to memory of 1736	1600	yxugwjud581.exe	42
PID 1600 wrote to memory of 1736	1600	yxugwjud581.exe	42
PID 1600 wrote to memory of 1736	1600	yxugwjud581.exe	42
PID 1600 wrote to memory of 316	1600	yxugwjud581.exe	43
PID 1600 wrote to memory of 316	1600	yxugwjud581.exe	43
PID 1600 wrote to memory of 316	1600	yxugwjud581.exe	43
PID 1600 wrote to memory of 316	1600	yxugwjud581.exe	43
PID 1600 wrote to memory of 1176	1600	yxugwjud581.exe	44
PID 1600 wrote to memory of 1176	1600	yxugwjud581.exe	44
PID 1600 wrote to memory of 1176	1600	yxugwjud581.exe	44
PID 1600 wrote to memory of 1176	1600	yxugwjud581.exe	44
PID 1600 wrote to memory of 1528	1600	yxugwjud581.exe	45
PID 1600 wrote to memory of 1528	1600	yxugwjud581.exe	45
PID 1600 wrote to memory of 1528	1600	yxugwjud581.exe	45
PID 1600 wrote to memory of 1528	1600	yxugwjud581.exe	45
PID 1600 wrote to memory of 1888	1600	yxugwjud581.exe	46
PID 1600 wrote to memory of 1888	1600	yxugwjud581.exe	46
PID 1600 wrote to memory of 1888	1600	yxugwjud581.exe	46
PID 1600 wrote to memory of 1888	1600	yxugwjud581.exe	46

C:\Users\Admin\AppData\Local\Temp\LockerGoga ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\LockerGoga ransomware.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y "C:\Users\Admin\AppData\Local\Temp\LockerGoga ransomware.exe" C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
  C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops desktop.ini file(s)
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops desktop.ini file(s)
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:480
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:808
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:992
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1772
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:480
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:480
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:480
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud581.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1244 -s 1556
1⤵
- Program crash
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
memory/1588-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download