Analysis
-
max time kernel
63s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/08/2024, 19:17
General
-
Target
https://cdn.discordapp.com/attachments/1250123717283942571/1257297706884534282/Loader.exe?ex=66ae153c&is=66acc3bc&hm=5984b63bead50f7311434ab816dd785cb6f31588f6c886728e76a3aceabf2757&
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 51 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
-
Suspicious use of FindShellTrayWindow 36 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1250123717283942571/1257297706884534282/Loader.exe?ex=66ae153c&is=66acc3bc&hm=5984b63bead50f7311434ab816dd785cb6f31588f6c886728e76a3aceabf2757&1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbf0b46f8,0x7ffdbf0b4708,0x7ffdbf0b47182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6188 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,44616155383443833,16191999359683728358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\Loader.exe"C:\Users\Admin\Downloads\Loader.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Loader.exe"C:\Users\Admin\Downloads\Loader.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe32⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe45⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe57⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe63⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe64⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe65⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe66⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe67⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe68⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe69⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe70⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe71⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe72⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe73⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe74⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe75⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe76⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe77⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe78⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe79⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe80⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe81⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe82⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe83⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe84⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe85⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe86⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe87⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe88⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe89⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe90⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe91⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe92⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe93⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe94⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe95⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe96⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe97⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe98⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe99⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe100⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe101⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe102⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe103⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe104⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe105⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe106⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe107⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe108⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe109⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe110⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe111⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe112⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe113⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe114⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe115⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe116⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe117⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe118⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe119⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe120⤵
-
C:\Users\Admin\Downloads\Loader.exeC:\Users\Admin\Downloads\Loader.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-