a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Size

2.6MB
MD5

674b5e533d8bceaccfd18aa8e5c4d8a2
SHA1

93f23682811395754497bd5d1b941a5d60639f5b
SHA256

a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2
SHA512

a815641bb49171e2578e2d8d4b9d9ef9b2bbb372de40aa9e5400b70af1b0b62ccbf71ae77a87e07a8751eef904bc02f211e298fee3bd51aec9e7e4f94f94c640
SSDEEP

49152:Ii39+084E6W4W8Vm/hH49aXZmMAxPHdgjMzoQXinnLYHiWEWcHRqhBB:H+HVb4W8QZ49unMHdBXqDRHEBB

Score

8^/10

persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 6 IoCs

pid	Process
2384	sg.tmp
2332	flushfont.exe
1800	flush++.exe
552	font.exe
2624	sg.tmp
2888	font.exe

Loads dropped DLL 6 IoCs

pid	Process
2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
552	font.exe
552	font.exe
552	font.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001661e-20.dat	upx
behavioral1/memory/552-28-0x0000000000400000-0x0000000000556000-memory.dmp	upx
behavioral1/memory/552-56-0x0000000000400000-0x0000000000556000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00070000000163b9-17.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
2852	taskkill.exe
1124	taskkill.exe
1040	taskkill.exe
956	taskkill.exe
2524	taskkill.exe
2688	taskkill.exe
1296	taskkill.exe
2332	taskkill.exe
2844	taskkill.exe
1164	taskkill.exe
696	taskkill.exe
996	taskkill.exe
2932	taskkill.exe
2204	taskkill.exe
1632	taskkill.exe
1852	taskkill.exe
2600	taskkill.exe
1956	taskkill.exe
468	taskkill.exe
644	taskkill.exe
2248	taskkill.exe
2276	taskkill.exe
772	taskkill.exe
1304	taskkill.exe
2968	taskkill.exe
1268	taskkill.exe
2312	taskkill.exe
548	taskkill.exe
468	taskkill.exe
2528	taskkill.exe
2860	taskkill.exe
2552	taskkill.exe
2796	taskkill.exe
2628	taskkill.exe
2180	taskkill.exe
2508	taskkill.exe
2292	taskkill.exe
1740	taskkill.exe
1580	taskkill.exe
916	taskkill.exe
1544	taskkill.exe
2164	taskkill.exe
892	taskkill.exe
2960	taskkill.exe
908	taskkill.exe
2756	taskkill.exe
1696	taskkill.exe
1360	taskkill.exe
2060	taskkill.exe
2248	taskkill.exe
2784	taskkill.exe
1668	taskkill.exe
564	taskkill.exe
2228	taskkill.exe
2552	taskkill.exe
2896	taskkill.exe
1520	taskkill.exe
2664	taskkill.exe
2476	taskkill.exe
2740	taskkill.exe
2276	taskkill.exe
1552	taskkill.exe
2468	taskkill.exe
2096	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
308	explorer.exe
1684	wscript.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeRestorePrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: 33	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeIncBasePriorityPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeCreateGlobalPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: 33	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeIncBasePriorityPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: 33	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeIncBasePriorityPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeRestorePrivilege	2384	sg.tmp
Token: 35	2384	sg.tmp
Token: SeSecurityPrivilege	2384	sg.tmp
Token: SeSecurityPrivilege	2384	sg.tmp
Token: 33	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeIncBasePriorityPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: SeBackupPrivilege	552	font.exe
Token: SeRestorePrivilege	552	font.exe
Token: 33	552	font.exe
Token: SeIncBasePriorityPrivilege	552	font.exe
Token: SeCreateGlobalPrivilege	552	font.exe
Token: 33	552	font.exe
Token: SeIncBasePriorityPrivilege	552	font.exe
Token: SeDebugPrivilege	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
Token: 33	552	font.exe
Token: SeIncBasePriorityPrivilege	552	font.exe
Token: SeRestorePrivilege	2624	sg.tmp
Token: 35	2624	sg.tmp
Token: SeSecurityPrivilege	2624	sg.tmp
Token: SeSecurityPrivilege	2624	sg.tmp
Token: 33	552	font.exe
Token: SeIncBasePriorityPrivilege	552	font.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	1876	taskkill.exe
Token: SeDebugPrivilege	696	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeShutdownPrivilege	308	explorer.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
1800	flush++.exe
1800	flush++.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
1800	flush++.exe
1800	flush++.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe
308	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2028	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	30
PID 2036 wrote to memory of 2028	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	30
PID 2036 wrote to memory of 2028	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	30
PID 2036 wrote to memory of 2028	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	30
PID 2036 wrote to memory of 2384	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	32
PID 2036 wrote to memory of 2384	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	32
PID 2036 wrote to memory of 2384	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	32
PID 2036 wrote to memory of 2384	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	32
PID 2036 wrote to memory of 2332	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	34
PID 2036 wrote to memory of 2332	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	34
PID 2036 wrote to memory of 2332	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	34
PID 2036 wrote to memory of 2332	2036	a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe	34
PID 2332 wrote to memory of 2740	2332	flushfont.exe	35
PID 2332 wrote to memory of 2740	2332	flushfont.exe	35
PID 2332 wrote to memory of 2740	2332	flushfont.exe	35
PID 2332 wrote to memory of 2740	2332	flushfont.exe	35
PID 2740 wrote to memory of 1800	2740	wscript.exe	36
PID 2740 wrote to memory of 1800	2740	wscript.exe	36
PID 2740 wrote to memory of 1800	2740	wscript.exe	36
PID 2740 wrote to memory of 1800	2740	wscript.exe	36
PID 2740 wrote to memory of 552	2740	wscript.exe	38
PID 2740 wrote to memory of 552	2740	wscript.exe	38
PID 2740 wrote to memory of 552	2740	wscript.exe	38
PID 2740 wrote to memory of 552	2740	wscript.exe	38
PID 552 wrote to memory of 2636	552	font.exe	39
PID 552 wrote to memory of 2636	552	font.exe	39
PID 552 wrote to memory of 2636	552	font.exe	39
PID 552 wrote to memory of 2636	552	font.exe	39
PID 552 wrote to memory of 2624	552	font.exe	41
PID 552 wrote to memory of 2624	552	font.exe	41
PID 552 wrote to memory of 2624	552	font.exe	41
PID 552 wrote to memory of 2624	552	font.exe	41
PID 552 wrote to memory of 2888	552	font.exe	43
PID 552 wrote to memory of 2888	552	font.exe	43
PID 552 wrote to memory of 2888	552	font.exe	43
PID 552 wrote to memory of 2888	552	font.exe	43
PID 2888 wrote to memory of 1684	2888	font.exe	44
PID 2888 wrote to memory of 1684	2888	font.exe	44
PID 2888 wrote to memory of 1684	2888	font.exe	44
PID 2888 wrote to memory of 1684	2888	font.exe	44
PID 1684 wrote to memory of 1156	1684	wscript.exe	45
PID 1684 wrote to memory of 1156	1684	wscript.exe	45
PID 1684 wrote to memory of 1156	1684	wscript.exe	45
PID 1156 wrote to memory of 1244	1156	cmd.exe	47
PID 1156 wrote to memory of 1244	1156	cmd.exe	47
PID 1156 wrote to memory of 1244	1156	cmd.exe	47
PID 1156 wrote to memory of 1164	1156	cmd.exe	49
PID 1156 wrote to memory of 1164	1156	cmd.exe	49
PID 1156 wrote to memory of 1164	1156	cmd.exe	49
PID 1156 wrote to memory of 2860	1156	cmd.exe	50
PID 1156 wrote to memory of 2860	1156	cmd.exe	50
PID 1156 wrote to memory of 2860	1156	cmd.exe	50
PID 1156 wrote to memory of 308	1156	cmd.exe	51
PID 1156 wrote to memory of 308	1156	cmd.exe	51
PID 1156 wrote to memory of 308	1156	cmd.exe	51
PID 1684 wrote to memory of 2216	1684	wscript.exe	52
PID 1684 wrote to memory of 2216	1684	wscript.exe	52
PID 1684 wrote to memory of 2216	1684	wscript.exe	52
PID 2216 wrote to memory of 2964	2216	cmd.exe	54
PID 2216 wrote to memory of 2964	2216	cmd.exe	54
PID 2216 wrote to memory of 2964	2216	cmd.exe	54
PID 2216 wrote to memory of 1944	2216	cmd.exe	56
PID 2216 wrote to memory of 1944	2216	cmd.exe	56
PID 2216 wrote to memory of 1944	2216	cmd.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe
"C:\Users\Admin\AppData\Local\Temp\a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\~5614298438672835400~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\a2283c410a6c147a7dbfc0624aaddf2b959d05dbad3d86ab87d19a1218d9d8f2.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flushfont.exe
  "C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flushfont.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C85E.tmp\C85F.tmp\C860.vbs //Nologo
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flush++.exe
      "C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flush++.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\font.exe
      "C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\font.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c set
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\~3411296260118334703~\sg.tmp
        
        7zG_exe x "C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\font.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\font_Altzin"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\font_Altzin\font.exe
        
        "C:\Users\Admin\AppData\Local\Temp\font_Altzin\font.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Windows\system32\wscript.exe
        
        "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\CB79.tmp\CB8A.tmp\CB8B.vbs //Nologo
        6⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\font.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im explorer.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Windows\explorer.exe
        
        explorer.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:308
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1136
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:3012
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1220
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1636
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2356
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1712
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2420
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2712
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1728
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2844
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1028
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:856
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1568
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2408
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:444
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1632
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1944
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:620
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2960
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1268
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2000
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1740
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1136
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2640
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2276
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1536
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1360
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1788
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1924
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2280
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2780
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1512
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:320
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1724
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:884
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2372
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2136
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1552
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2012
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2400
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:3016
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2292
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2900
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2864
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2688
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2644
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2736
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2308
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2828
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2312
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:772
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2508
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2852
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1824
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:468
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2160
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2464
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1772
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1296
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1700
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:620
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:3004
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:892
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:852
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1040
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:3012
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:780
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1860
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1544
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1864
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2100
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:936
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:996
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1580
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1636
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:408
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2980
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2920
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2796
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1836
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2788
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2896
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2432
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2596
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2712
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2332
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:768
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2648
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2036
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1584
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2932
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1872
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1960
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2412
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:820
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:548
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1944
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2456
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1700
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1816
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:696
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:916
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1876
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1928
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2568
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2256
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2968
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1512
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1668
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2460
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:884
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1964
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2396
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2368
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2340
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2756
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2740
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2760
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2664
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2600
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2768
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2644
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2448
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2028
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2504
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2648
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2508
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1936
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2176
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1752
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1960
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:548
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2196
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1888
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2000
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:696
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:892
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2784
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1928
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1040
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1360
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:264
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1544
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:936
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2452
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2460
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1820
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1088
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2532
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2128
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2340
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1520
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1892
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2756
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2820
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2760
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2060
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2620
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2892
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2140
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2332
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1244
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1764
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2072
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2024
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2508
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1620
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1660
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2576
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:3004
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:860
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2492
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1340
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:908
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1796
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1336
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1492
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:564
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2040
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1564
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1612
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1852
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1668
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2460
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2204
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2300
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1964
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:884
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2776
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2188
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2752
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1836
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2128
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2420
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2812
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2916
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2292
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2844
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1812
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2648
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2660
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1568
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2312
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2228
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2172
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2468
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1732
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2444
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2576
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2092
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2492
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2116
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:892
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2000
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1536
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1040
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1044
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2252
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2276
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:484
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1652
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1512
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2204
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1984
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:884
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:408
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2364
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2188
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2528
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2740
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2128
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2096
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2664
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2760
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2284
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2512
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2844
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2332
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2688
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1028
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2660
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1872
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2312
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2160
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2464
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2468
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:820
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1660
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2480
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:956
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1700
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1672
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1720
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1548
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:3012
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2000
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2476
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1040
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1740
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1760
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1488
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1544
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:936
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:320
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2460
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1088
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1552
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:408
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2364
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2560
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2528
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2740
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2136
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2400
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2264
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2868
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2820
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2900
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1292
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1980
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:768
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2736
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1744
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1768
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1936
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2024
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2412
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1060
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1620
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2960
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1312
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:956
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1700
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1032
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1136
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1560
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2784
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1740
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:3052
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1200
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1488
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:3068
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2780
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:320
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:484
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:1580
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1088
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2552
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1820
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:580
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2364
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2488
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1196
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2740
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2604
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2656
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:2096
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2760
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2880
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2944
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2844
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2028
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2688
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1764
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1872
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2216
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1592
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1568
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:2576
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:2960
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:956
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1300
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat" "
        7⤵
        
        PID:1816
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        Kills process with taskkill
        
        PID:908
        
        C:\Windows\system32\taskkill.exe
        
        Taskkill -f -im fontdrvhost.exe
        8⤵
        
        PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C85E.tmp\C85F.tmp\C860.vbs

Filesize
158B

MD5
972d491373866ba14fe7f2cc12ada577

SHA1
972aa11309cacf8ea78d3a1aa178ca4f551d2ca1

SHA256
770f2643f011e6801a18b3e74d49bcd4bcfc16b17c5d52f6a8e4cfe5331d4998

SHA512
f98acd3f04cc29bcc8d3d5d56adb5250fa9c4024b495bd33c41adad300a39c4c3a38c217551655c951ba2e3f3d75af9faaaa12fad8f20993d1bac65df544bf45

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB79.tmp\CB8A.tmp\CB8B.vbs

Filesize
224B

MD5
e24d987189f32ce49d1feb85409077a2

SHA1
95b0917aab25da1f62daaa53c1635fd32e95554b

SHA256
fc41034924233c496e0d48044a0d5eb0892712cd508dbf00d5a57280f0fbbd49

SHA512
435631a7afe7b724bf84263b74624005fc4878e0b5c1a3a01e975e6aa535d2fa27edd6028cd49d827a822705eaafc52070017f1a8a72d8bd6fa31ab9b2e10a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flush++.exe

Filesize
888KB

MD5
4a858c7fe48f2bc247a5f9bd6c9f7a1e

SHA1
ae36263714ef00a5eda92db930c12cd63437f907

SHA256
207841de327fca849de51d42f2a98c187e958c9252a6b8ea422f834e706c1b3c

SHA512
34972f5727957d1e833d4bd243d9edc533bee00f5a2d9a5af2ce3f04bf61512a664dc42519f1024870e42c8bd5fdd1ceace9bb4da8796af8f0d149f522e57b8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flushfont.exe

Filesize
84KB

MD5
e8f5d106c22ccdb5d1baaf44b8bef83a

SHA1
996ac9e9b69553a097b0f85992e4c1cd66cb7fc5

SHA256
5e85d9e43277c3c13f8fcf3a8a1d264a8ce91f039ba160a12684df607481b423

SHA512
42edd0123b2e45338ed6e3639ffb7253098b1765837cdb2e7d987a4ac8fc54a2b7a5f170a044553b542bbe1dcd201eee1a99a879d2325401ef33cda3de8a51f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\flushfont.vbs

Filesize
1KB

MD5
2f28d6e4d67d94ec184fa65e27ace0e1

SHA1
1d4da04406130dc866acab5ead07a65b9ec87007

SHA256
f54889e3e0428599585bedfe581f8ab0b0bceb19205763e5756893ac56c450e7

SHA512
5ec09fdcda2c4fac61d0a20c8a5a67bf8b00f9bc8f68ce3157a1daf50212d76086015450c05c92d1e050072c947aa4020b73b2852eafd7adebe2fe6546d3d824

Download Submit
C:\Users\Admin\AppData\Local\Temp\flushfont_Altzin\font.exe

Filesize
951KB

MD5
d96957cc9e532953bbcf2cb0fded1c5a

SHA1
924d3587a2d13c73d57e92951c67e145d560f513

SHA256
29752e6b9ec8ef221217d43d3175d6fc7883a627b9b6783ebf52bec2c3db4f48

SHA512
37412ccc35b554a8131ba96a37d24bfca2fdf7b7713c71bdce44f3a5a021c229646240f14327d41dcb5214ec990d0d9391ebd8dc8d2665fd3d9ef0eb19a1feee

Download Submit
C:\Users\Admin\AppData\Local\Temp\font_Altzin\font.bat

Filesize
125B

MD5
a6a8f82efd225929b95b0f4436b2cbe6

SHA1
75230ba2d8dfb52d944ca5aefc22315046d7d36e

SHA256
be21feec2424d5b22cc7b7d04fcc4762a52164e951efd02cfeb11e444c9826e4

SHA512
de924c514722e75c2f016c06f9c975f8f6dc46a86630be7ff423233374d252cce311ac949cd22cc27b4483bc68ea49de815e23bc3573817aef5d0fb922bb2279

Download Submit
C:\Users\Admin\AppData\Local\Temp\font_Altzin\font.exe

Filesize
84KB

MD5
f0771620423172f019fdd918f57fd422

SHA1
12a19e56dd243006103955adb4d74a7d6932d22b

SHA256
538caee248621aafd26664d46f498bc8bc0486c49be374c758afbb013b7fcce0

SHA512
879dbe1a20f6aca6e713e68b2a1b56e95c1cf9a743b7b3c317dd12aebd4a031e58130fdea0437a2fe3d793f4778374c4a2830958ecccf77c94b3762d03fdb06b

Download Submit
C:\Users\Admin\AppData\Local\Temp\font_Altzin\font.vbs

Filesize
226B

MD5
45db1e12079a2b73dd071a5c0facb075

SHA1
3d90184229d51cada644842bed1e6cd526670d8f

SHA256
3e99d7d6c7ff0459e60e65880999715386feca10721a6ff85bf33e44ebd0199a

SHA512
7d7d1e5529ef57907e16ab240a87cc668a521b4319cbbf4ce5df7eaa33fcb8f3182dd485e31495a0eb69fe210b84dea967e1778f118d7e2f320e29be2c6a8613

Download Submit
C:\Users\Admin\AppData\Local\Temp\font_Altzin\fontk.bat

Filesize
75B

MD5
57ebf785da8b002dbba878fc773704b3

SHA1
2623f09e237606ae095bf47132b0d28161258fd6

SHA256
fcedca8f8389bc503277aca6b73d82053302f3ba1d866486ec8638fb5d8d6bd7

SHA512
95159a00d5da1ad5aba817a1c47d73c8a24cab1b151d130fc8b4c96d6e558b14bc37279785ea2a4f52adf85fa1cab962c443aa0a70568a0cd4fef8c202866db3

Download Submit
\Users\Admin\AppData\Local\Temp\~5614298438672835400~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/308-73-0x0000000002630000-0x0000000002640000-memory.dmp

Filesize
64KB

Download
memory/552-28-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download
memory/552-56-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download