lockergoga | eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0

Analysis

max time kernel
46s
max time network
114s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/01/2023, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Size

1.2MB
MD5

16bcc3b7f32c41e7c7222bf37fe39fe6
SHA1

a25bc5442c86bdeb0dec6583f0e80e241745fb73
SHA256

eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0
SHA512

f3e7087f569b3bcc201c006c5dfcea6cf560cad480bc03e6f17790190bc35bf6659e91a9f91219952bd139a3c9afde961032ee1d0861158409206feaa6540f9e
SSDEEP

24576:uj/6CtkHRos9l+zan4Q6eQqF5ZgQibE2zkMiJHic9OuTw258tox6T9G0SKoRl:A/NtkHRos9l+zan4QTB/2zkPtBq2itoP

Score

10^/10

lockergoga banker ransomware trojan

Malware Config

Extracted

Path

C:\Users\Public\Desktop\README_LOCKED.txt

Ransom Note

Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: [email protected] [email protected]

Emails

[email protected]

Signatures

LockerGoga
LockerGoga is a ransomware that is primarily used in targeted, disruptive attacks.
trojan banker lockergoga

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\WT61FR.LEX	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM	yxugwjud1599.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\THMBNAIL.PNG	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\THMBNAIL.PNG	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\VSTARemotingServer.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\MSB1ENES.ITS	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBUI6.CHM	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\VSTARemotingServer.tlb	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\flyout.css	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\THMBNAIL.PNG	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBHW6.CHM	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoBase.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\settings.css	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\MSOSVINT.DLL	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\settings.js	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\THMBNAIL.PNG	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG	yxugwjud1599.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	yxugwjud1599.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBOB6.CHM	yxugwjud1599.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\THMBNAIL.PNG	yxugwjud1599.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll	yxugwjud1599.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1272	WerFault.exe	16

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
580	yxugwjud1599.exe
580	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
1212	yxugwjud1599.exe
1212	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
1212	yxugwjud1599.exe
1212	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
1212	yxugwjud1599.exe
1212	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
1212	yxugwjud1599.exe
1212	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe
580	yxugwjud1599.exe
580	yxugwjud1599.exe
560	yxugwjud1599.exe
560	yxugwjud1599.exe
1428	yxugwjud1599.exe
1428	yxugwjud1599.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1704	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Token: SeBackupPrivilege	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Token: SeRestorePrivilege	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Token: SeLockMemoryPrivilege	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Token: SeCreateGlobalPrivilege	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
Token: SeDebugPrivilege	1676	yxugwjud1599.exe
Token: SeBackupPrivilege	1676	yxugwjud1599.exe
Token: SeRestorePrivilege	1676	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1676	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1676	yxugwjud1599.exe
Token: SeDebugPrivilege	560	yxugwjud1599.exe
Token: SeBackupPrivilege	560	yxugwjud1599.exe
Token: SeRestorePrivilege	560	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	560	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	560	yxugwjud1599.exe
Token: SeDebugPrivilege	1428	yxugwjud1599.exe
Token: SeDebugPrivilege	580	yxugwjud1599.exe
Token: SeBackupPrivilege	1428	yxugwjud1599.exe
Token: SeRestorePrivilege	1428	yxugwjud1599.exe
Token: SeBackupPrivilege	580	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1428	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1428	yxugwjud1599.exe
Token: SeRestorePrivilege	580	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	580	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	580	yxugwjud1599.exe
Token: SeDebugPrivilege	1212	yxugwjud1599.exe
Token: SeBackupPrivilege	1212	yxugwjud1599.exe
Token: SeRestorePrivilege	1212	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1212	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1212	yxugwjud1599.exe
Token: SeDebugPrivilege	1512	yxugwjud1599.exe
Token: SeBackupPrivilege	1512	yxugwjud1599.exe
Token: SeRestorePrivilege	1512	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1512	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1512	yxugwjud1599.exe
Token: SeDebugPrivilege	1332	yxugwjud1599.exe
Token: SeBackupPrivilege	1332	yxugwjud1599.exe
Token: SeRestorePrivilege	1332	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1332	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1332	yxugwjud1599.exe
Token: SeDebugPrivilege	1712	yxugwjud1599.exe
Token: SeBackupPrivilege	1712	yxugwjud1599.exe
Token: SeRestorePrivilege	1712	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1712	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1712	yxugwjud1599.exe
Token: SeDebugPrivilege	524	yxugwjud1599.exe
Token: SeBackupPrivilege	524	yxugwjud1599.exe
Token: SeRestorePrivilege	524	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	524	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	524	yxugwjud1599.exe
Token: SeDebugPrivilege	1128	yxugwjud1599.exe
Token: SeBackupPrivilege	1128	yxugwjud1599.exe
Token: SeRestorePrivilege	1128	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1128	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	1128	yxugwjud1599.exe
Token: SeDebugPrivilege	2032	yxugwjud1599.exe
Token: SeBackupPrivilege	2032	yxugwjud1599.exe
Token: SeRestorePrivilege	2032	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	2032	yxugwjud1599.exe
Token: SeCreateGlobalPrivilege	2032	yxugwjud1599.exe
Token: SeDebugPrivilege	1800	yxugwjud1599.exe
Token: SeBackupPrivilege	1800	yxugwjud1599.exe
Token: SeRestorePrivilege	1800	yxugwjud1599.exe
Token: SeLockMemoryPrivilege	1800	yxugwjud1599.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1704	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	28
PID 840 wrote to memory of 1704	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	28
PID 840 wrote to memory of 1704	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	28
PID 840 wrote to memory of 1704	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	28
PID 840 wrote to memory of 1676	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	30
PID 840 wrote to memory of 1676	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	30
PID 840 wrote to memory of 1676	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	30
PID 840 wrote to memory of 1676	840	eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe	30
PID 1676 wrote to memory of 560	1676	yxugwjud1599.exe	34
PID 1676 wrote to memory of 560	1676	yxugwjud1599.exe	34
PID 1676 wrote to memory of 560	1676	yxugwjud1599.exe	34
PID 1676 wrote to memory of 560	1676	yxugwjud1599.exe	34
PID 1676 wrote to memory of 1428	1676	yxugwjud1599.exe	33
PID 1676 wrote to memory of 1428	1676	yxugwjud1599.exe	33
PID 1676 wrote to memory of 1428	1676	yxugwjud1599.exe	33
PID 1676 wrote to memory of 1428	1676	yxugwjud1599.exe	33
PID 1676 wrote to memory of 1212	1676	yxugwjud1599.exe	32
PID 1676 wrote to memory of 1212	1676	yxugwjud1599.exe	32
PID 1676 wrote to memory of 1212	1676	yxugwjud1599.exe	32
PID 1676 wrote to memory of 1212	1676	yxugwjud1599.exe	32
PID 1676 wrote to memory of 580	1676	yxugwjud1599.exe	31
PID 1676 wrote to memory of 580	1676	yxugwjud1599.exe	31
PID 1676 wrote to memory of 580	1676	yxugwjud1599.exe	31
PID 1676 wrote to memory of 580	1676	yxugwjud1599.exe	31
PID 1676 wrote to memory of 1512	1676	yxugwjud1599.exe	36
PID 1676 wrote to memory of 1512	1676	yxugwjud1599.exe	36
PID 1676 wrote to memory of 1512	1676	yxugwjud1599.exe	36
PID 1676 wrote to memory of 1512	1676	yxugwjud1599.exe	36
PID 1676 wrote to memory of 1332	1676	yxugwjud1599.exe	37
PID 1676 wrote to memory of 1332	1676	yxugwjud1599.exe	37
PID 1676 wrote to memory of 1332	1676	yxugwjud1599.exe	37
PID 1676 wrote to memory of 1332	1676	yxugwjud1599.exe	37
PID 1676 wrote to memory of 1712	1676	yxugwjud1599.exe	38
PID 1676 wrote to memory of 1712	1676	yxugwjud1599.exe	38
PID 1676 wrote to memory of 1712	1676	yxugwjud1599.exe	38
PID 1676 wrote to memory of 1712	1676	yxugwjud1599.exe	38
PID 1676 wrote to memory of 524	1676	yxugwjud1599.exe	41
PID 1676 wrote to memory of 524	1676	yxugwjud1599.exe	41
PID 1676 wrote to memory of 524	1676	yxugwjud1599.exe	41
PID 1676 wrote to memory of 524	1676	yxugwjud1599.exe	41
PID 1676 wrote to memory of 2032	1676	yxugwjud1599.exe	39
PID 1676 wrote to memory of 2032	1676	yxugwjud1599.exe	39
PID 1676 wrote to memory of 2032	1676	yxugwjud1599.exe	39
PID 1676 wrote to memory of 2032	1676	yxugwjud1599.exe	39
PID 1676 wrote to memory of 1128	1676	yxugwjud1599.exe	40
PID 1676 wrote to memory of 1128	1676	yxugwjud1599.exe	40
PID 1676 wrote to memory of 1128	1676	yxugwjud1599.exe	40
PID 1676 wrote to memory of 1128	1676	yxugwjud1599.exe	40
PID 1676 wrote to memory of 1800	1676	yxugwjud1599.exe	44
PID 1676 wrote to memory of 1800	1676	yxugwjud1599.exe	44
PID 1676 wrote to memory of 1800	1676	yxugwjud1599.exe	44
PID 1676 wrote to memory of 1800	1676	yxugwjud1599.exe	44
PID 1676 wrote to memory of 1444	1676	yxugwjud1599.exe	68
PID 1676 wrote to memory of 1444	1676	yxugwjud1599.exe	68
PID 1676 wrote to memory of 1444	1676	yxugwjud1599.exe	68
PID 1676 wrote to memory of 1444	1676	yxugwjud1599.exe	68
PID 1676 wrote to memory of 1640	1676	yxugwjud1599.exe	45
PID 1676 wrote to memory of 1640	1676	yxugwjud1599.exe	45
PID 1676 wrote to memory of 1640	1676	yxugwjud1599.exe	45
PID 1676 wrote to memory of 1640	1676	yxugwjud1599.exe	45
PID 1676 wrote to memory of 364	1676	yxugwjud1599.exe	46
PID 1676 wrote to memory of 364	1676	yxugwjud1599.exe	46
PID 1676 wrote to memory of 364	1676	yxugwjud1599.exe	46
PID 1676 wrote to memory of 364	1676	yxugwjud1599.exe	46

C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe
"C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move /y C:\Users\Admin\AppData\Local\Temp\eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
  C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -m
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:364
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:384
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:936
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:608
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:364
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    - Drops file in Program Files directory
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:108
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:480
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1880
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe
    C:\Users\Admin\AppData\Local\Temp\yxugwjud1599.exe -i Global\SM-yxugwjud -s
    3⤵
    PID:1168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1272 -s 1416
1⤵
- Program crash
PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
C:\Users\Public\Desktop\README_LOCKED.txt

Filesize
1KB

MD5
bf41f65f8a5b7c27752368238ea18595

SHA1
4bbe26657dbfc8d5e57d2dbcf3d7f987094a8dbb

SHA256
544779e2ee93f79d33708e37f1b07817d5427f70895ce9c440125f2631acdf53

SHA512
3864ff7d0cd5e9f3c8425da83970d0e27b9e97c6d32b6159b6330367f1fa0daca2d1b2d169f417563827440020c99e983d6166b3aec845720140fc4ac3674335

Download Submit
memory/840-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download