Overview

overview

10

Static

static

3

topaz vide...ws.exe

windows10-1703-x64

10

topaz vide...ws.exe

windows11-21h2-x64

10

EarthAccep...tation

windows10-1703-x64

1

EarthAccep...tation

windows11-21h2-x64

1

Resubmissions

23-09-2024 16:46

240923-t983fatbnp 8

23-09-2024 16:39

240923-t587mswgrf 7

23-09-2024 08:53

240923-ktpjeswhnc 10

Analysis

  • max time kernel
    604s
  • max time network
    610s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23-09-2024 08:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    topaz video enhance ai crack windows/topaz video enhance ai crack windows.exe

  • Size

    816.4MB

  • MD5

    0ed473ad80f4539c46f043e7d14d4e85

  • SHA1

    112d4a25c16a12190e8bc8d5c35346d0eb47acb8

  • SHA256

    a903f61b3327529f59ef005efa7b41bdd91ce259b8f4422e1c9c13e5267b2117

  • SHA512

    47ef94feb19a7d8de63ae45949369c37624e801afcaed80f31556f700389f8ec02d0546de3a5eda7ae83d2724e8860d7b5b8882ccbdb7e0be766cd280ea8c320

  • SSDEEP

    393216:TAVchpPmaXtrAPxE3DjM16vbuo6EigC/Reiaqakjaz8BTwZeJkjoboj:ucFtkPxlqKo6T3Rtg8hv0

Score
10/10
redlinestealcvidar3a15237aa92dcd8ccca447211fb5fc2adefaultlogsdiller cloud (tg: @logsdillabot)bootkitcredential_accessdiscoveryevasionexecutioninfostealerpersistencespywarestealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

193.3.168.69:41193

Extracted

Family

vidar

Version

11

Botnet

3a15237aa92dcd8ccca447211fb5fc2a

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Signatures

  • Detect Vidar Stealer 5 IoCs
    stealer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates processes with tasklist 1 TTPs 10 IoCs
    discovery
  • Suspicious use of SetThreadContext 15 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe
    "C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Lo Lo.bat & Lo.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3860
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "wrsa opssvc"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1292
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4608
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c md 582717
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2612
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "AppleNeCordConvergence" Talent
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4068
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c copy /b ..\Girl + ..\Lions + ..\Meetings + ..\With + ..\Ab + ..\Genes + ..\Panama + ..\Niger + ..\Genome + ..\Anger + ..\Sandwich + ..\Therapist + ..\Unto + ..\Are + ..\Flashing + ..\Disks + ..\Dist + ..\Preserve + ..\Becomes + ..\Mission + ..\Andorra + ..\Victory + ..\Limitation + ..\Deviation + ..\Met + ..\Prevent + ..\Massive + ..\Worlds b
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2040
      • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
        Maryland.pif b
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
          C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4772
          • C:\Users\Admin\Documents\iofolko5\uE1_3XwF9otJ3ku1TzVjsZNK.exe
            C:\Users\Admin\Documents\iofolko5\uE1_3XwF9otJ3ku1TzVjsZNK.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:4212
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:796
          • C:\Users\Admin\Documents\iofolko5\4iipGpXJuiJmnz3J5bEQSCNl.exe
            C:\Users\Admin\Documents\iofolko5\4iipGpXJuiJmnz3J5bEQSCNl.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1432
            • C:\Users\Admin\Documents\iofolko5\4iipGpXJuiJmnz3J5bEQSCNl.exe
              "C:\Users\Admin\Documents\iofolko5\4iipGpXJuiJmnz3J5bEQSCNl.exe"
              6⤵
              • Executes dropped EXE
              PID:4080
          • C:\Users\Admin\Documents\iofolko5\czZvnqll0P651IweCpKgpDPr.exe
            C:\Users\Admin\Documents\iofolko5\czZvnqll0P651IweCpKgpDPr.exe
            5⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:3200
            • C:\Users\Admin\AppData\Local\Temp\service123.exe
              "C:\Users\Admin\AppData\Local\Temp\service123.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:8
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4588
          • C:\Users\Admin\Documents\iofolko5\jV9NyWgUi2Gjt9Q1o1izph5I.exe
            C:\Users\Admin\Documents\iofolko5\jV9NyWgUi2Gjt9Q1o1izph5I.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2860
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
                PID:4536
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:4048
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:3596
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3904
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminFBAAAKFCAF.exe"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:1572
                      • C:\Users\AdminFBAAAKFCAF.exe
                        "C:\Users\AdminFBAAAKFCAF.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:3600
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          9⤵
                          • System Location Discovery: System Language Discovery
                          PID:5096
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHDHCFIJEGC.exe"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:4072
                      • C:\Users\AdminHDHCFIJEGC.exe
                        "C:\Users\AdminHDHCFIJEGC.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:3728
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          9⤵
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4028
                • C:\Users\Admin\Documents\iofolko5\yH2JaQ5BHBvrOWW2jdKV6pCD.exe
                  C:\Users\Admin\Documents\iofolko5\yH2JaQ5BHBvrOWW2jdKV6pCD.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2388
                • C:\Users\Admin\Documents\iofolko5\BoH6KvOU7m6frOeTERY79iFW.exe
                  C:\Users\Admin\Documents\iofolko5\BoH6KvOU7m6frOeTERY79iFW.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4968
                  • C:\Users\Admin\AppData\Local\Temp\is-TCP5I.tmp\BoH6KvOU7m6frOeTERY79iFW.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-TCP5I.tmp\BoH6KvOU7m6frOeTERY79iFW.tmp" /SL5="$202D4,2862397,56832,C:\Users\Admin\Documents\iofolko5\BoH6KvOU7m6frOeTERY79iFW.exe"
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:4924
                    • C:\Users\Admin\AppData\Local\Nikkitos Screen Recorder\nikkitosscreenrecorder.exe
                      "C:\Users\Admin\AppData\Local\Nikkitos Screen Recorder\nikkitosscreenrecorder.exe" -i
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1032
                • C:\Users\Admin\Documents\iofolko5\1J3IJRzTS6RLB8alpR40ZpR4.exe
                  C:\Users\Admin\Documents\iofolko5\1J3IJRzTS6RLB8alpR40ZpR4.exe
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:684
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2752
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4608
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1716
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4664
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe delete "RRTELIGS"
                    6⤵
                    • Launches sc.exe
                    PID:3936
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "RRTELIGS" binpath= "C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe" start= "auto"
                    6⤵
                    • Launches sc.exe
                    PID:3848
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop eventlog
                    6⤵
                    • Launches sc.exe
                    PID:1468
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start "RRTELIGS"
                    6⤵
                    • Launches sc.exe
                    PID:3012
                • C:\Users\Admin\Documents\iofolko5\ygVdpFQ_3IuFHioGS5u6Hdz6.exe
                  C:\Users\Admin\Documents\iofolko5\ygVdpFQ_3IuFHioGS5u6Hdz6.exe
                  5⤵
                  • Executes dropped EXE
                  • Writes to the Master Boot Record (MBR)
                  PID:2160
                • C:\Users\Admin\Documents\iofolko5\tqEHBKTQM3gd122PpLGfXzAC.exe
                  C:\Users\Admin\Documents\iofolko5\tqEHBKTQM3gd122PpLGfXzAC.exe
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:672
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies system certificate store
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2868
                • C:\Users\Admin\Documents\iofolko5\8_QCmKzr7Dee8zsoAnqyyOjq.exe
                  C:\Users\Admin\Documents\iofolko5\8_QCmKzr7Dee8zsoAnqyyOjq.exe
                  5⤵
                  • Executes dropped EXE
                  PID:3920
                • C:\Users\Admin\Documents\iofolko5\DxD89Va1PaqkJ_jMpoLc6YV8.exe
                  C:\Users\Admin\Documents\iofolko5\DxD89Va1PaqkJ_jMpoLc6YV8.exe
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2584
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:2648
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:2380
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:2260
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1296
                          7⤵
                          • Program crash
                          PID:3776
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1260
                          7⤵
                          • Program crash
                          PID:4844
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1316
                          7⤵
                          • Program crash
                          PID:4724
                    • C:\Users\Admin\Documents\iofolko5\NzNx5hYvcbQFkOd8h_DeJlxQ.exe
                      C:\Users\Admin\Documents\iofolko5\NzNx5hYvcbQFkOd8h_DeJlxQ.exe
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:5084
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4988
                        • C:\ProgramData\AKJKFBAFID.exe
                          "C:\ProgramData\AKJKFBAFID.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:1208
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            8⤵
                              PID:4184
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              8⤵
                                PID:2772
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                8⤵
                                • System Location Discovery: System Language Discovery
                                PID:2816
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CFBFHIEBKJKF" & exit
                              7⤵
                              • System Location Discovery: System Language Discovery
                              PID:4992
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /t 10
                                8⤵
                                • System Location Discovery: System Language Discovery
                                • Delays execution with timeout.exe
                                PID:1152
                    • C:\Windows\SysWOW64\choice.exe
                      choice /d y /t 5
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2876
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:3780
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2260 -ip 2260
                    1⤵
                      PID:4660
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2260 -ip 2260
                      1⤵
                        PID:2752
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2260 -ip 2260
                        1⤵
                          PID:4944
                        • C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
                          C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3172
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                            2⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4064
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                            2⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2088
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                            2⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4752
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                            2⤵
                            • Power Settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2316
                          • C:\Windows\system32\conhost.exe
                            C:\Windows\system32\conhost.exe
                            2⤵
                              PID:2376
                            • C:\Windows\system32\svchost.exe
                              svchost.exe
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3120
                          • C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe
                            "C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe"
                            1⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:756
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c move Lo Lo.bat & Lo.bat
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1492
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist
                                3⤵
                                • Enumerates processes with tasklist
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4572
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr /I "wrsa opssvc"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:4660
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist
                                3⤵
                                • Enumerates processes with tasklist
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1440
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                3⤵
                                  PID:1784
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c md 582717
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4592
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /V "AppleNeCordConvergence" Talent
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3992
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c copy /b ..\Girl + ..\Lions + ..\Meetings + ..\With + ..\Ab + ..\Genes + ..\Panama + ..\Niger + ..\Genome + ..\Anger + ..\Sandwich + ..\Therapist + ..\Unto + ..\Are + ..\Flashing + ..\Disks + ..\Dist + ..\Preserve + ..\Becomes + ..\Mission + ..\Andorra + ..\Victory + ..\Limitation + ..\Deviation + ..\Met + ..\Prevent + ..\Massive + ..\Worlds b
                                  3⤵
                                    PID:4652
                                  • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                    Maryland.pif b
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:4636
                                    • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                      C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1392
                                  • C:\Windows\SysWOW64\choice.exe
                                    choice /d y /t 5
                                    3⤵
                                      PID:2464
                                • C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe
                                  "C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe"
                                  1⤵
                                  • Drops file in Windows directory
                                  PID:4952
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c move Lo Lo.bat & Lo.bat
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1140
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      3⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4772
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr /I "wrsa opssvc"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4552
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      3⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2104
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:668
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c md 582717
                                      3⤵
                                        PID:4536
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /V "AppleNeCordConvergence" Talent
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2556
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c copy /b ..\Girl + ..\Lions + ..\Meetings + ..\With + ..\Ab + ..\Genes + ..\Panama + ..\Niger + ..\Genome + ..\Anger + ..\Sandwich + ..\Therapist + ..\Unto + ..\Are + ..\Flashing + ..\Disks + ..\Dist + ..\Preserve + ..\Becomes + ..\Mission + ..\Andorra + ..\Victory + ..\Limitation + ..\Deviation + ..\Met + ..\Prevent + ..\Massive + ..\Worlds b
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1848
                                      • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                        Maryland.pif b
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:4944
                                        • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                          C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                          4⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2612
                                      • C:\Windows\SysWOW64\choice.exe
                                        choice /d y /t 5
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4392
                                  • C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe
                                    "C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe"
                                    1⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4320
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c move Lo Lo.bat & Lo.bat
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4564
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist
                                        3⤵
                                        • Enumerates processes with tasklist
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4860
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /I "wrsa opssvc"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5072
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist
                                        3⤵
                                        • Enumerates processes with tasklist
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:684
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1692
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c md 582717
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4248
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /V "AppleNeCordConvergence" Talent
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4976
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c copy /b ..\Girl + ..\Lions + ..\Meetings + ..\With + ..\Ab + ..\Genes + ..\Panama + ..\Niger + ..\Genome + ..\Anger + ..\Sandwich + ..\Therapist + ..\Unto + ..\Are + ..\Flashing + ..\Disks + ..\Dist + ..\Preserve + ..\Becomes + ..\Mission + ..\Andorra + ..\Victory + ..\Limitation + ..\Deviation + ..\Met + ..\Prevent + ..\Massive + ..\Worlds b
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3596
                                      • C:\Windows\SysWOW64\choice.exe
                                        choice /d y /t 5
                                        3⤵
                                          PID:5096
                                    • C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe
                                      "C:\Users\Admin\AppData\Local\Temp\topaz video enhance ai crack windows\topaz video enhance ai crack windows.exe"
                                      1⤵
                                      • Drops file in Windows directory
                                      PID:3388
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c move Lo Lo.bat & Lo.bat
                                        2⤵
                                          PID:4092
                                          • C:\Windows\SysWOW64\tasklist.exe
                                            tasklist
                                            3⤵
                                            • Enumerates processes with tasklist
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3192
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /I "wrsa opssvc"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3496
                                          • C:\Windows\SysWOW64\tasklist.exe
                                            tasklist
                                            3⤵
                                            • Enumerates processes with tasklist
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4840
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4856
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c md 582717
                                            3⤵
                                              PID:124
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c copy /b ..\Girl + ..\Lions + ..\Meetings + ..\With + ..\Ab + ..\Genes + ..\Panama + ..\Niger + ..\Genome + ..\Anger + ..\Sandwich + ..\Therapist + ..\Unto + ..\Are + ..\Flashing + ..\Disks + ..\Dist + ..\Preserve + ..\Becomes + ..\Mission + ..\Andorra + ..\Victory + ..\Limitation + ..\Deviation + ..\Met + ..\Prevent + ..\Massive + ..\Worlds b
                                              3⤵
                                                PID:2636
                                              • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                                Maryland.pif b
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:4352
                                                • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                                  C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:1676
                                              • C:\Windows\SysWOW64\choice.exe
                                                choice /d y /t 5
                                                3⤵
                                                  PID:1036
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4328
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3424
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4596
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:2400
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4400
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:952
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3332
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3572
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4336

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            System Services

                                            2
                                            T1569

                                            Service Execution

                                            2
                                            T1569.002

                                            Persistence

                                            Create or Modify System Process

                                            2
                                            T1543

                                            Windows Service

                                            2
                                            T1543.003

                                            Power Settings

                                            1
                                            T1653

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Privilege Escalation

                                            Create or Modify System Process

                                            2
                                            T1543

                                            Windows Service

                                            2
                                            T1543.003

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Defense Evasion

                                            Impair Defenses

                                            1
                                            T1562

                                            Modify Registry

                                            1
                                            T1112

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Subvert Trust Controls

                                            1
                                            T1553

                                            Install Root Certificate

                                            1
                                            T1553.004

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Unsecured Credentials

                                            4
                                            T1552

                                            Credentials In Files

                                            4
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Process Discovery

                                            1
                                            T1057

                                            Query Registry

                                            2
                                            T1012

                                            System Information Discovery

                                            2
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            3
                                            T1005

                                            Command and Control

                                            Web Service

                                            1
                                            T1102

                                            Exfiltration

                                            Impact

                                            Service Stop

                                            1
                                            T1489

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\ProgramData\BKECBAKFBGDG\BAECFC
                                              Filesize

                                              40KB

                                              MD5

                                              a182561a527f929489bf4b8f74f65cd7

                                              SHA1

                                              8cd6866594759711ea1836e86a5b7ca64ee8911f

                                              SHA256

                                              42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                              SHA512

                                              9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                              Download Submit

                                            • C:\ProgramData\BKECBAKFBGDG\BAECFC
                                              Filesize

                                              160KB

                                              MD5

                                              f310cf1ff562ae14449e0167a3e1fe46

                                              SHA1

                                              85c58afa9049467031c6c2b17f5c12ca73bb2788

                                              SHA256

                                              e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                              SHA512

                                              1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                              Download Submit

                                            • C:\ProgramData\BKECBAKFBGDG\DHJDAK
                                              Filesize

                                              20KB

                                              MD5

                                              a603e09d617fea7517059b4924b1df93

                                              SHA1

                                              31d66e1496e0229c6a312f8be05da3f813b3fa9e

                                              SHA256

                                              ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

                                              SHA512

                                              eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

                                              Download Submit

                                            • C:\ProgramData\CFBFHIEBKJKF\CFCGII
                                              Filesize

                                              112KB

                                              MD5

                                              87210e9e528a4ddb09c6b671937c79c6

                                              SHA1

                                              3c75314714619f5b55e25769e0985d497f0062f2

                                              SHA256

                                              eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

                                              SHA512

                                              f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

                                              Download Submit

                                            • C:\ProgramData\CFBFHIEBKJKF\EHJDGC
                                              Filesize

                                              10KB

                                              MD5

                                              f8a9703f6dde2a80f9579012461ed793

                                              SHA1

                                              136cb815c00d5a770dc8a496344ce11d175211c7

                                              SHA256

                                              008a2c27b0c31f52dbacbb994be0f90aa1018adbbf03d36c8d32e46d86fceaf7

                                              SHA512

                                              81aad4631c036da656d55e060b132bd1427c243d94e6079d88dfe4c10c7bf4a51a02ab215111ef9ffe83768a137bc2548edeea764fa3069197716fe2dce549af

                                              Download Submit

                                            • C:\ProgramData\CFBFHIEBKJKF\FBAAAK
                                              Filesize

                                              114KB

                                              MD5

                                              8fd0d4d921529f90e6d9cf62bc44ac9f

                                              SHA1

                                              9fe0dd1b7ef2c9b53002fcd0566ba30a456f0a18

                                              SHA256

                                              15e476add372f7ec56b514354e10f3b824f42eca23705f550cc4de49d3016bda

                                              SHA512

                                              a6869c6e20ca12a139afdfe96af667031650ebbca62fbf6ac01edf8b94e78ba1eb893e0f618742a7639bae1c5bea100d94afa26d2df33a8af6fc64d8814f152a

                                              Download Submit

                                            • C:\ProgramData\mozglue.dll
                                              Filesize

                                              593KB

                                              MD5

                                              c8fd9be83bc728cc04beffafc2907fe9

                                              SHA1

                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                              SHA256

                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                              SHA512

                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                              Download Submit

                                            • C:\ProgramData\nss3.dll
                                              Filesize

                                              2.0MB

                                              MD5

                                              1cc453cdf74f31e4d913ff9c10acdde2

                                              SHA1

                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                              SHA256

                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                              SHA512

                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                              Download Submit

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
                                              Filesize

                                              400B

                                              MD5

                                              4db63f4ff3b1b00819c715a2defa6f4b

                                              SHA1

                                              b5fda8c0a43775298c22778bb0fde484d4acfd4c

                                              SHA256

                                              2633222f89ea0cf5bed8e895677cd1335c70d0eac3764055defaf9bb753a9460

                                              SHA512

                                              80f6fbeaf7a4686b12a978dce4ce0ea32f6339f337e53a396320e9f7299e91a347d8ace72cde89a8f5c23ba432fef78bc1c07073c5f0344878b6a9b0fa653577

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AdminFBAAAKFCAF.exe.log
                                              Filesize

                                              425B

                                              MD5

                                              bb27934be8860266d478c13f2d65f45e

                                              SHA1

                                              a69a0e171864dcac9ade1b04fc0313e6b4024ccb

                                              SHA256

                                              85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

                                              SHA512

                                              87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\12KX1S8M\66eef0ca0fb35_lfdsa[1].exe
                                              Filesize

                                              381KB

                                              MD5

                                              f5a1956973dce107d4c0b6267ce88870

                                              SHA1

                                              79a19513d7c9cff939f2881c4172a05dbaef735b

                                              SHA256

                                              7b794c5bdb820791f0359da90a9a4f258412b8feef9c6e6a0411f6aead9d3a04

                                              SHA512

                                              f42180c75c0ae8dc083c6fff98a66c0d875fadb400d7945816ea330a54777632a3a7752d3e78b90e45f58ed3d04d6708b1dcea51d82711356e6d14e405a7c579

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Nikkitos Screen Recorder\nikkitosscreenrecorder.exe
                                              Filesize

                                              2.6MB

                                              MD5

                                              1f4abb409b8a4600ec497a139d308d7b

                                              SHA1

                                              1a7546c0e4d871348b355c274d7f2672c3257545

                                              SHA256

                                              e07e050594db8583d4132d4b3b0cf4f2b97a10837739a0777118aae5b912847a

                                              SHA512

                                              cda8bf35e1ad21138f19cccea13749fe8d79a5efa33a5a768b0ff46cd53cceaf5163829c234c22db020087673fecb2e46db0b40c2f7c908e7a97239212fd652e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\582717\Maryland.pif
                                              Filesize

                                              872KB

                                              MD5

                                              18ce19b57f43ce0a5af149c96aecc685

                                              SHA1

                                              1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                              SHA256

                                              d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                              SHA512

                                              a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\582717\b
                                              Filesize

                                              1.9MB

                                              MD5

                                              6d174513fbee6ddbfad3910bd033459a

                                              SHA1

                                              8d28ad16148814034a78595dba063bcce596fcbe

                                              SHA256

                                              cecc7c943a43c742266a434053acfe9d6665023425613eb454024f7380c4e833

                                              SHA512

                                              384757b880f6686e28e247583e23f7bcb0103e724603e2b552a06773a6d853e4cc65577806a689190e2d0d8b0efdbee4737688ce6f789c19919724653c9bc60f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Ab
                                              Filesize

                                              87KB

                                              MD5

                                              c3d7681658631a2550d329e8858cd4d0

                                              SHA1

                                              cffd5d84597c39e801b3f27a3406d4d4cfbb8213

                                              SHA256

                                              4da93fbd06b1f8fcdfd083738e2a7ac3a93debf374b5e7c80ff68c959947308d

                                              SHA512

                                              ef963da5ff8618e05dd330d760ab1f4f3640bb0de240aa7321c9a4f38b2d63797b961224ea7e3f40a421c3d6897812f3cfab3d05652daf80b662612b83c8254f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Andorra
                                              Filesize

                                              60KB

                                              MD5

                                              a33ca1f3026fd3ff8e9030c81314a3a4

                                              SHA1

                                              0f60dc58b4d5a88810ce18d577693bee388a04d5

                                              SHA256

                                              de6d85d289b7d6dc4c9274a8a3367e31adf4325e1a85d4af1ab376675881b928

                                              SHA512

                                              b0138d3cd57a17301863996e2f32ddee9ab57e9964290241cc88c7e456a83f2c82a03929d8613eb3aa6f5170adea86f99e16f5b468b5b98693f2d71195679909

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Anger
                                              Filesize

                                              74KB

                                              MD5

                                              fff6d9433273992327280118b97029b4

                                              SHA1

                                              a2c855f9be6f988b8c8a0ec328608224e89dddaf

                                              SHA256

                                              eef3c6317e9f86b49493c37b20fb28d42adb297feff0e3f19c2aa6aa116491ae

                                              SHA512

                                              9500f6e1ceeb819455852e012d48635ef3c4cccae7988c91dcf7e15a15f5b1dcedc24cbc71142a4d8855c4c13d8f8fd37e5300329f761bdde7d44fc0972116a6

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Are
                                              Filesize

                                              64KB

                                              MD5

                                              0936eb21aa46a93d7bef524bb232d5d2

                                              SHA1

                                              d06a9d2c45bc2815d92551c0e0b38de82100cb25

                                              SHA256

                                              e9f4f20d5cf325db423a8884060a1b52aaa2b7d129ba732d94533df228611474

                                              SHA512

                                              554c7a60bed7d8610776122d0f99e53d88631fa9e9ba5b13322fa86e920d985a28246bfa22f5cddbae8e84d629e15ab485840462acbf4a717bd7b88af2b33479

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Becomes
                                              Filesize

                                              81KB

                                              MD5

                                              a9df2b0b02a74e8ed85560bc59aa6381

                                              SHA1

                                              fc7f0df073df454ae3b9989a9f8e8647c05c8b5a

                                              SHA256

                                              2e490ef6a85275fb5db7d0762ca6d7ac8bac95437646ca9bc029983fcd4b7928

                                              SHA512

                                              055b2b8bf6ec865be9488ee993b5366981989ed23ee98c4b243bf2cc3e8bf776bdcd4a0e9f386440019a23663f2032cf797a9612a26bf4094195892c8e55faeb

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Deviation
                                              Filesize

                                              77KB

                                              MD5

                                              2af511a959e248836bd1cb8d71a115b2

                                              SHA1

                                              eda54900227dc1146ba8e5821e500c8a942c7e9f

                                              SHA256

                                              777bd339d1de721bd28c4d167fe88c1016cea82a2288bf748d9473b6a1871813

                                              SHA512

                                              055b6b6f4f8953d44ee3a9da744845565f047ea5fe4066a54013914a1f68ec41cd1646bf31440d4f2166f952f025aa5464b2653b1f0de9f512dc05abbbe4bd9d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Disks
                                              Filesize

                                              72KB

                                              MD5

                                              d54aec4d487099604271466c2ad292f9

                                              SHA1

                                              ced16eace86ab62a1e0af8c3f8ce1d7e7f8f2c2e

                                              SHA256

                                              6f1736c3ad969a224abf3100b31dd73d4389fe9d7a22de3eb35e5b77caa7a05f

                                              SHA512

                                              633542cbd489d2c531dfbe9af7f17f2728877b327c6bf43fad08b10c1e48ae27737bd1422ece8554505134a5b99f8c7f3e4de6f33e8a42159fd8df5e35bceca1

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Dist
                                              Filesize

                                              52KB

                                              MD5

                                              3db84bdce37176e8ded0c0d6a95efde7

                                              SHA1

                                              2f11a1c7b19f4c91d4c6794ed066fbf0a1c2a22d

                                              SHA256

                                              efd1a6dd0cde66d67594291ab6a3fba5ffd597c5321d808d992f0cf6336f037d

                                              SHA512

                                              8dc0e874aace0c529ad2b50033b8673e0c308dd2ff1a26c24b9cac61b41a0aec02867d59f7684a2d9f7c7afe06f4eb53bb8b7f276a2febad34b7c6a9bcaebc31

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Flashing
                                              Filesize

                                              63KB

                                              MD5

                                              24755334ef1c47f4ca103e769d88cdf9

                                              SHA1

                                              cb719671fe06516fa520913cf8d986427cdf8460

                                              SHA256

                                              b141464642bd173808821467aa5a1d0abe21a7b7692ed88c3405d3c8c79e43cb

                                              SHA512

                                              5104c93256294a6d9f00e3d4a1a6773cf75007167538315b13d3a3c379a1ffbaafc0ed6735a5df163fb988c6ce33a63af2bee16d9b269a93b954a59f614e3dea

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Genes
                                              Filesize

                                              81KB

                                              MD5

                                              643ef5e0c59ae81ed477ceb7969d02d6

                                              SHA1

                                              576f6226c83f0342e5e3e9463f4df025b107c63f

                                              SHA256

                                              2d7a719c1d2fef1f7a29d5ca96510fcbcd64ac4221017bb2620cf8c344a5fd77

                                              SHA512

                                              e80227c65a975a4c6e8d7486b1448de3232b25febaaa14ebc94d1a31d7b3177e715cf40855bd0fece689f7803d84976c8defaa8ad027369c529ca87b196cf3da

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Genome
                                              Filesize

                                              50KB

                                              MD5

                                              ed287bde22e278bc26ddbbb86e3b91fa

                                              SHA1

                                              f8b53295a7a9e0899dc5643e920165447514b6b7

                                              SHA256

                                              625c7a85b64ec467b39b5eacd5d22cdebe061c4071733e9468a5b25a34b74bbd

                                              SHA512

                                              248d0a95dc6de9df50c35c263a7b82270d8c1ad22e974890a878f6a90151528a33b5ed67ff6c119a0705f06af1fe7aadd31a9eebd04ace33bda97faa567c9c11

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Girl
                                              Filesize

                                              54KB

                                              MD5

                                              721754267f69e93dd4d5c8e182614b62

                                              SHA1

                                              71842854960c32d9c958fe6729703b5c0d834a80

                                              SHA256

                                              fd7c8d87ec3969f6b038ccac564880a403679f05fde9f7056b6aaebcb5628ef7

                                              SHA512

                                              b62bcdf4ace7e84058b14f1376abcc8356371979f99c80d4f32262b01e5e58daffe3c44286f269e4a39bee6b773ed039969fa4c97af3be0eab8c4a6d7b6e192c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Housing
                                              Filesize

                                              866KB

                                              MD5

                                              7260f9e276e7bafa4e7a86322be79063

                                              SHA1

                                              8fda4776421b93b49141315015feab0e1a06b1b7

                                              SHA256

                                              80b681291a1adcb5d815a8bf4e4e614fbd02291dd138bbc9180052be5d047952

                                              SHA512

                                              287d8a5c0b98470cf0563185bafc8c956a3fb0493e17c09377a20ce0577b83b45942b421dcd24bb195a1b0676f7b021f035f8601e1e08499a71f11db6f732ed7

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Limitation
                                              Filesize

                                              80KB

                                              MD5

                                              0732937d35617fc70025d70b3101ad38

                                              SHA1

                                              1f822534503e8b7c433f1133c6325a8bb9c4656a

                                              SHA256

                                              d0345655474b9da78e7374784e0e7629787307f55033c5243e3681181eac8682

                                              SHA512

                                              62b872630d820dcdd7b545ec7fc74f1acf304c3ca4cc361a677cdf834f31fca2ce2cb67e2f69c267efc493f3bfd7ce2c33529fbf5fcb405a2b9da89029db874e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Lions
                                              Filesize

                                              76KB

                                              MD5

                                              1e24a6ce4a4c6454aee239d81b489e12

                                              SHA1

                                              522f510442507c74868ee422917d82fdf5b920f2

                                              SHA256

                                              e096b81d83ca822b5048ea25876fd0f21b3281f48ee27b915a2d599c40dc1c06

                                              SHA512

                                              16e19dc487ef9be63083cbeca59182d4be5b868f77b7f443e1e549a08fae0aaeca09817347196bb6b343db604b493b8298935af94da8899e8c9c1078666e02c2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Lo
                                              Filesize

                                              10KB

                                              MD5

                                              47e9c8413366f4d9abf4ea0e939d64ec

                                              SHA1

                                              8f706abc89c4557b21318ac0aea04a5f771409b1

                                              SHA256

                                              7d3cd3055dca4b7cdd6f3e3f539433a7e798d3682b369fcabf8b53df91899041

                                              SHA512

                                              d178e0cf94c668c32a87a5e0d45cb0f440514a8718592640d39156d4e6915dc6fadb0993f8b3a9a2b56e32adee4f493ffb55614ec1b79ab09c20768f19f595d5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Massive
                                              Filesize

                                              65KB

                                              MD5

                                              7768f7cd4a2b20b422b8a55cefceb59e

                                              SHA1

                                              c823ef7e83f5092d7ce0d7b0bf122b0f89ff3a24

                                              SHA256

                                              5690b771c5da8666b37344cc5e4aec70ef1d4419f71acefa8dc9f286f6a29461

                                              SHA512

                                              6b2c36a43b0fb9c31a3564b0b2273ddde3511172fb75e6f1129242bf94bf107cd47d1837bc5a0d94f58ea5702f25d8de63932ecc981fdc69e6b3e0995d4454fe

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Meetings
                                              Filesize

                                              88KB

                                              MD5

                                              941282ba0f71a37f14fbffbe843cbe35

                                              SHA1

                                              fec73e735d22cce2217058fc8a0c99c11531e5a8

                                              SHA256

                                              2bd30ea74d45ccccdff9564642b8ed4626a9ca6498a568fe82e524d92affa1d1

                                              SHA512

                                              69cd070511c752b8c2a7c33ff5efc5c30324817e57dc0a7f83c525a6af36ddfdd27ede5a84f209ef08fbc18abb21ab6750eea0273accb8dc1de885ecdefcf112

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Met
                                              Filesize

                                              62KB

                                              MD5

                                              9a728b96437d0ed586802eaf8da2739c

                                              SHA1

                                              1a5d0d6082f3e937b62145097d3149c9aed521ed

                                              SHA256

                                              c8a6bb646c0e77bbb74360fae2ad4a2140bb308d43e164c4c0cc9909243882c0

                                              SHA512

                                              8c57128d1adb1963399d5ab0990767e175db347db7c8b754d3171c9a37995cdedf536d994e3b288d0c8f4176f80bf8db5e2ef085e935c105b60a8bbc93677bcf

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Mission
                                              Filesize

                                              55KB

                                              MD5

                                              282b6137108f3ab85b992f371407fa2e

                                              SHA1

                                              72990ada04a24cae336dcabfe6a184332dbd4ed7

                                              SHA256

                                              fb3e910820d529fbfc7695502b80013784aeca3b26a3e1d8e7c85ac5f2318812

                                              SHA512

                                              a2a9cc7f3d17873e7d9e706fc0a56a17a0424bc917cc6f724be0a6ae3a8c1a96ac41fb1d3498a1b680bc02cb2cf529239019b2c8f4d77cdcc7eb5bd395c75b4b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Niger
                                              Filesize

                                              66KB

                                              MD5

                                              7319ccbc06c0f43059961df55449fd74

                                              SHA1

                                              3526024279d8fbdae070639b22f8f2789eb4f54a

                                              SHA256

                                              bf641c5acbc0db6bc3ac8500457f7c8da5e38d3c5f37b0eb0c0d238bbbcf48e2

                                              SHA512

                                              e8e35c63c39edd6d16d0469f40917feee9f0c6f87b7cdf43424c218d430b59b8805da540c890c15258bc51a3fc0bdb8a3f8712694773564ca070f60116bf473b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Panama
                                              Filesize

                                              60KB

                                              MD5

                                              9267679da65c13c62b6c9ed0d701df06

                                              SHA1

                                              1926f6894f926b5583dbbd1b068b0054aa65670e

                                              SHA256

                                              6a8816143be9e48a49cadee908a8684fc1ad53e254aed611fd84dc6c0461e913

                                              SHA512

                                              19c1fd6361d7d403e75c1bd503eb22d90de3c3d538433695caff080b65eff1a45f3f4bbd22c76c699e072ffadb5cca2eb262babfd8987c4774a12b6da0c9d457

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Preserve
                                              Filesize

                                              85KB

                                              MD5

                                              54cb682c32d61911cf60e3d6e052bf19

                                              SHA1

                                              9e9da7249f0443ca09a1ccce25b0a5e7b213f55c

                                              SHA256

                                              00f576edb92b94b054c31b303f7dd4d7ca0ac36e2362f57353033a50864d81ed

                                              SHA512

                                              b87ff6eec70bf0b4ccbdc1f20d8c7486392dd7d8aad8b8e24518a5bd8651d2d61feebd10771af63d96c31a3c8f2ea4586f81a6e81669fd8b6f45221fc0c95a24

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Prevent
                                              Filesize

                                              68KB

                                              MD5

                                              46885de7fd3ff3ab68002f3cccec4b77

                                              SHA1

                                              f6f17fef216a7521f8c81202ef0d157091f105e7

                                              SHA256

                                              09885ee28e3d7f797ef1d0db27878420f02f5570d5968a6388b2e65b702c6420

                                              SHA512

                                              0e2ebb615ca2fe18845f91f41e847c74c58a628e9da01928ed37d5e891d029b7c45964c7f5253c6562fd75bc4728a0f0686689d1a3a0f338d5c305b4682fae07

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Sandwich
                                              Filesize

                                              94KB

                                              MD5

                                              a2f625653582868237c2c02135f58148

                                              SHA1

                                              1947698285f6858525a0e663537e15df7405875f

                                              SHA256

                                              d740f2a29c34d1def3b0090e4f425f7b4629ce338700bef4cddf68855e5ecc07

                                              SHA512

                                              4547a0d0b1cb422963048f37cc380d63025fa6ceded1e723f426d0af5c5f51cf229362bf0def9707830a49b788bae64c11c5d982dd0d3c0bdbd871751ac7bb32

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Talent
                                              Filesize

                                              6KB

                                              MD5

                                              c3617efce1e2f86ae068294bb5bd5f07

                                              SHA1

                                              ee6f9e7a98fd8a0c7d1fd5b00b1c7b2cfa23dfb8

                                              SHA256

                                              e6f210612a96d3059865ab8ac42ecd63c1df225a8893420163b7d59ad3fa00a2

                                              SHA512

                                              3429e81d322f9ce275baff399fd21fa9254a7e2445752cc4c0c5706c631606d0bfd07ce488008277233f36ada84205a113bb8358676a19ca438fc0bb1fa185de

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Therapist
                                              Filesize

                                              59KB

                                              MD5

                                              288856f5328a297ca650dbfdb08016dc

                                              SHA1

                                              c7fdcd3da6f97ea398bccdfc09c19b0e4b7bf9f3

                                              SHA256

                                              99b9ea5533c22f4c032f8c436074f4100439945c8fdef3d18aa15d3d5b66ac18

                                              SHA512

                                              113c5342b3a6177daeaf7373120e17811d6d2faa0c090e4dee28911c3c85d3ac54bc798e6061cfe5e30cb2cd25222d22050626dd7bde5022a4ceabe9dc1e24ee

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\TmpAB4E.tmp
                                              Filesize

                                              2KB

                                              MD5

                                              1420d30f964eac2c85b2ccfe968eebce

                                              SHA1

                                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                              SHA256

                                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                              SHA512

                                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Unto
                                              Filesize

                                              82KB

                                              MD5

                                              39695106af0d352588ec217fb30bba41

                                              SHA1

                                              9748ca8c66ba7e3973c869a21c116a1869e87f14

                                              SHA256

                                              99a97e4d5fe43111fddc745f7b2b801ac9220c5457c0b335d62ac99e64190d02

                                              SHA512

                                              e0d8680142c01085f1af8437408fd98224f62347b3e0f263ebd68f489b57c188a2ee3d1f391d621ad4e54eeccca1cb6b51dd1327a648c87bcd39e071e006e23f

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Victory
                                              Filesize

                                              52KB

                                              MD5

                                              881d19bf173c88643cf15e0e3368d9fa

                                              SHA1

                                              6a6620849affb2d6710847620492190e2432080e

                                              SHA256

                                              d2fa013df807555b102d65a755d08c588e58e2f1e24ca196606f5aa4bfe5246c

                                              SHA512

                                              ef3dc5fcb6ef0ee8e62b1af902662580da2e4bbdb493f0f5e165c44a7124a5786967b6f78e713891df0ebef96d374458c7163554bd11768db54b822d286fd729

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\With
                                              Filesize

                                              59KB

                                              MD5

                                              c0f7adf931dce385829b67e1f4e20c82

                                              SHA1

                                              71d32a50c33e5bb666ca89c8f1c876c3d2dda2e6

                                              SHA256

                                              29f8c5595e89ed845c6f1c6bd9db87879d7290f81160f3590a6e37ce1ec09926

                                              SHA512

                                              3b70b98616fd1f9bda7ba80feea25a8325be459ceab71213fbddff80b69ceaeb748a5ed77ede607d9f30f1d227ba0ca318aaeb5e29ae6893ef19230efb71591d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\Worlds
                                              Filesize

                                              33KB

                                              MD5

                                              38b47459aefdbbfc34543bd4f6cfc102

                                              SHA1

                                              2a590edad9714735f48aa76420f428958b7e8958

                                              SHA256

                                              4ce0d5b780ef8eccf55cb15a01352e2e92ff94a085d01c1077e43c2ea3982428

                                              SHA512

                                              e6f130f54d25143980c77947c4091a16a26973bc866143afa8fa5efc304a2e3fc3cb80b85ab1c5c91152e30b37e93b76aa19de682d9de08f82f64768cd619e66

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\is-S3ATD.tmp\_isetup\_iscrypt.dll
                                              Filesize

                                              2KB

                                              MD5

                                              a69559718ab506675e907fe49deb71e9

                                              SHA1

                                              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                              SHA256

                                              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                              SHA512

                                              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\is-TCP5I.tmp\BoH6KvOU7m6frOeTERY79iFW.tmp
                                              Filesize

                                              691KB

                                              MD5

                                              09fc27a149d2e93a6ce508e7e631e7dd

                                              SHA1

                                              283a293c229af7cddc5d51f0d04b1bbe406bd088

                                              SHA256

                                              d8c00c5cea289e511aa7fffc88e07fc9f526776ac2b21d50dda3ebb2ddb5acc8

                                              SHA512

                                              df41e98ac60c616263f24a5d494ad1f5ff97d2330543e7a3eadad3b209d62f10cea198b2906b35a86817e30216e9836de574ced71e71bdf90093c5318ee0488e

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\1J3IJRzTS6RLB8alpR40ZpR4.exe
                                              Filesize

                                              11.0MB

                                              MD5

                                              d60d266e8fbdbd7794653ecf2aba26ed

                                              SHA1

                                              469ed7d853d590e90f05bdf77af114b84c88de2c

                                              SHA256

                                              d4df1aba83289161d578336e1b7b6daf7269bb73acc92bd9dfa2c262ebc6c4d2

                                              SHA512

                                              80df5d568e34dfc086f546e8d076749e58a7230ed1aa33f3a5c9d966809becadc9922317095032d6e6a7ecdfbfbce02a72cc82513ab0d132c5ffa6c07682bd87

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\4iipGpXJuiJmnz3J5bEQSCNl.exe
                                              Filesize

                                              4.1MB

                                              MD5

                                              abdbcc23bd8f767e671bac6d2ff60335

                                              SHA1

                                              18ca867c0502b353e9aad63553efd4eb4e25723f

                                              SHA256

                                              45a7b861baac5f8234433fefd9dbdd0a5f288a18b72346b6b6917cf56882bf85

                                              SHA512

                                              67c00713e6d24d192c0f8e3e49fa146418faf72b2bb42c276ad560f08e39c68f4ab446c47c7e7710778aee9ca1f193ad65e061645b6bcec414844165b5e16bc7

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\8_QCmKzr7Dee8zsoAnqyyOjq.exe
                                              Filesize

                                              402KB

                                              MD5

                                              8298633a9314793be6b79c257929903b

                                              SHA1

                                              fafc6a837a29c647250338f14f9b6289e4c5b624

                                              SHA256

                                              56aec8ee198131b8e621e152ec748a6e0b957edf2603e7c0876827cf3a1a364c

                                              SHA512

                                              3a8e34a25bba5a3eaed96b7f4b3550cc99f548f412622ceadbd481ab5e86f2941d2af17af31de1354aac9f4060374312689831cfac9ec327ccd4ce0473700911

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\BoH6KvOU7m6frOeTERY79iFW.exe
                                              Filesize

                                              3.0MB

                                              MD5

                                              5ed7b8ab23b223e058261d7898172c1a

                                              SHA1

                                              7a3f0b626d5a18fc09e767716e37c8b152dcbb7d

                                              SHA256

                                              6bc84bd401a258cac58e3c562481601d35ef2feadde7c0cb367fbaf0702e9dc3

                                              SHA512

                                              a6e281ecb227eb20eb3e93203d83ce8d62e45bfaf7c5b195698abb8fa08ffb50804b217388712e13c70b9d43e55e25f5c84f03e35976201f26d47077c5f4563a

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\DxD89Va1PaqkJ_jMpoLc6YV8.exe
                                              Filesize

                                              361KB

                                              MD5

                                              06d5c3c3c249ea51791336557cdc619b

                                              SHA1

                                              05d372af9e9085f6076fbd0833094edb32b2c9b1

                                              SHA256

                                              a72d4d0ece553b8140a169f5aca11693f3e411f733f1440ec12b1a30b323f164

                                              SHA512

                                              c5073ecfaa57bc584254bce7e07d0d67023c0602cfa2901f498ae48bd42020acd62d45a002ec6eddae2847a55863721f18508726344e05a50fbfc117e4a03b5e

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\NzNx5hYvcbQFkOd8h_DeJlxQ.exe
                                              Filesize

                                              413KB

                                              MD5

                                              76b81bbaa929e92a0885267869e62fdf

                                              SHA1

                                              16ee3b53fd9d0fe6bd7fc75ac961a21bfd9fae51

                                              SHA256

                                              f59f82ea9cbaa95389bbec5f80b427daa2e575c2827eaaede006590810809f9c

                                              SHA512

                                              67d4fb8ed2c767871a307c54fddc86fa4df07ccfa943eeb61e6e8960c4038fb8a38118a69cbb7a6364dde6c11fd3139b8c5f91e029a437dad0d39202383ac3cd

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\czZvnqll0P651IweCpKgpDPr.exe
                                              Filesize

                                              6.4MB

                                              MD5

                                              666cf8a81ba6f3c5bb9b61d200584441

                                              SHA1

                                              78d1cde65dbd232930a836f00d3c37003f583b6f

                                              SHA256

                                              0b14c37c84d89fd4939173c7cdb22f18c76098756fdb90694a63232f68530050

                                              SHA512

                                              74cf1412c37d40dd009395bc0899af7b19b80f0649011102b87356b597d08bd31beb3e75aa6b8356323097aa05d411159590cf0aaa7a86b4355e36f2be4a36e0

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\jV9NyWgUi2Gjt9Q1o1izph5I.exe
                                              Filesize

                                              216KB

                                              MD5

                                              9a29528b1463ae389bd3e03e4e686a56

                                              SHA1

                                              0cefb61f8615c6ed5606360db20adecdedf4c59c

                                              SHA256

                                              a0add2ff01fd0b1c7a259a9b0f0bdee713a7edbbf12fa18820fc95a373254e3b

                                              SHA512

                                              34743dd19630de9802258476e6c9aacd14b7338c9e1c22c0369e759844b3248570b272c7edbc89079fe5eb8f375c7e2680e71f88ab5b8a4c01ba4d7ef116f9ae

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\tqEHBKTQM3gd122PpLGfXzAC.exe
                                              Filesize

                                              313KB

                                              MD5

                                              6423234685ca0046f61adac81f3b71d2

                                              SHA1

                                              138de6c0170db1a72203475b94583b7f06fbaf1f

                                              SHA256

                                              2982d7fbda8b889a9cc7ea780acd6ab1e03dc69360836a3a60bae08ae6307ad5

                                              SHA512

                                              07ec233c53057f26ecfccd9b3a6e27de373d980fa760c689468357c5f7a8f8f1020aada9263545b38fd8dd19af91cbca2a1006f30294abde278c1c0dec42d3fb

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\uE1_3XwF9otJ3ku1TzVjsZNK.exe
                                              Filesize

                                              21.4MB

                                              MD5

                                              cb3952f1852179348f8d2db91760d03b

                                              SHA1

                                              4d2c9d9b09226524868760263c873edc664456a9

                                              SHA256

                                              a9ea40670a686e175cc8c32e3fc6ba92505379303d6524f149022490a2dda181

                                              SHA512

                                              163006435a30b31ff0b079215efc0cedf6a624516af1ffccbc6144cfdb205b822029d523f28ec86e0391af1b741771b860cf4d3492c87567a55f541a39c69d11

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\yH2JaQ5BHBvrOWW2jdKV6pCD.exe
                                              Filesize

                                              249KB

                                              MD5

                                              d56bea8714d3b0d71a4905b3e9103e03

                                              SHA1

                                              f87548174e258b4e9aaf02a76d28874b87413f54

                                              SHA256

                                              c27e2d17cf286c37d3691b278c530c70911950db0c7bbc4e57523ecf325f1547

                                              SHA512

                                              ca1cda273c0f828fb1773ae7fb06e01be85416b757777461db460a4c421802d0d33e2f5a23823197767871531efbce8eb65adf0cb7f716994ad7ea2e10fafa37

                                              Download Submit

                                            • C:\Users\Admin\Documents\iofolko5\ygVdpFQ_3IuFHioGS5u6Hdz6.exe
                                              Filesize

                                              421KB

                                              MD5

                                              59f2f7f0cf8faf41dbb0a7878b5d66bb

                                              SHA1

                                              0a96781c3e937cd7c12a052242f4755ea3656297

                                              SHA256

                                              683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584

                                              SHA512

                                              f3c6bc3fe42dbf48bda944817718298c9e23b7b6c08d7ff3142dfbc82b9a5070090ba80ce8dad8bc7b99e334f888bad3b6109142b5dc063a5ef73883f2b87ccd

                                              Download Submit

                                            • memory/672-264-0x0000000000FB0000-0x0000000001004000-memory.dmp

                                              Filesize

                                              336KB

                                              Download

                                            • memory/684-339-0x0000000140000000-0x0000000141A86000-memory.dmp

                                              Filesize

                                              26.5MB

                                              Download

                                            • memory/684-337-0x00007FFE38BF0000-0x00007FFE38BF2000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/1032-296-0x0000000000400000-0x00000000006A6000-memory.dmp

                                              Filesize

                                              2.6MB

                                              Download

                                            • memory/1032-299-0x0000000000400000-0x00000000006A6000-memory.dmp

                                              Filesize

                                              2.6MB

                                              Download

                                            • memory/1032-794-0x0000000000400000-0x00000000006A6000-memory.dmp

                                              Filesize

                                              2.6MB

                                              Download

                                            • memory/1432-620-0x00000000058F0000-0x0000000005912000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/1432-619-0x0000000005770000-0x00000000058EC000-memory.dmp

                                              Filesize

                                              1.5MB

                                              Download

                                            • memory/1432-258-0x0000000000500000-0x0000000000914000-memory.dmp

                                              Filesize

                                              4.1MB

                                              Download

                                            • memory/1432-277-0x00000000052B0000-0x000000000534C000-memory.dmp

                                              Filesize

                                              624KB

                                              Download

                                            • memory/2260-345-0x0000000000400000-0x0000000000464000-memory.dmp

                                              Filesize

                                              400KB

                                              Download

                                            • memory/2260-347-0x0000000000400000-0x0000000000464000-memory.dmp

                                              Filesize

                                              400KB

                                              Download

                                            • memory/2260-342-0x0000000000400000-0x0000000000464000-memory.dmp

                                              Filesize

                                              400KB

                                              Download

                                            • memory/2584-265-0x0000000000D90000-0x0000000000DF0000-memory.dmp

                                              Filesize

                                              384KB

                                              Download

                                            • memory/2860-272-0x0000000000470000-0x00000000004A8000-memory.dmp

                                              Filesize

                                              224KB

                                              Download

                                            • memory/2868-354-0x0000000006A50000-0x0000000006B5A000-memory.dmp

                                              Filesize

                                              1.0MB

                                              Download

                                            • memory/2868-897-0x00000000059B0000-0x0000000005A16000-memory.dmp

                                              Filesize

                                              408KB

                                              Download

                                            • memory/2868-357-0x0000000006B60000-0x0000000006BAC000-memory.dmp

                                              Filesize

                                              304KB

                                              Download

                                            • memory/2868-900-0x0000000007B10000-0x0000000007B60000-memory.dmp

                                              Filesize

                                              320KB

                                              Download

                                            • memory/2868-355-0x0000000006990000-0x00000000069A2000-memory.dmp

                                              Filesize

                                              72KB

                                              Download

                                            • memory/2868-353-0x0000000006F00000-0x0000000007518000-memory.dmp

                                              Filesize

                                              6.1MB

                                              Download

                                            • memory/2868-341-0x0000000006240000-0x00000000062B6000-memory.dmp

                                              Filesize

                                              472KB

                                              Download

                                            • memory/2868-348-0x00000000068C0000-0x00000000068DE000-memory.dmp

                                              Filesize

                                              120KB

                                              Download

                                            • memory/2868-321-0x00000000054F0000-0x00000000054FA000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/2868-356-0x00000000069F0000-0x0000000006A2C000-memory.dmp

                                              Filesize

                                              240KB

                                              Download

                                            • memory/2868-305-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/2868-898-0x00000000076F0000-0x00000000078B2000-memory.dmp

                                              Filesize

                                              1.8MB

                                              Download

                                            • memory/2868-899-0x0000000007FF0000-0x000000000851C000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/2868-313-0x0000000005C10000-0x00000000061B6000-memory.dmp

                                              Filesize

                                              5.6MB

                                              Download

                                            • memory/2868-319-0x0000000005660000-0x00000000056F2000-memory.dmp

                                              Filesize

                                              584KB

                                              Download

                                            • memory/3600-452-0x0000000000740000-0x00000000007A0000-memory.dmp

                                              Filesize

                                              384KB

                                              Download

                                            • memory/3904-316-0x0000000000400000-0x0000000000643000-memory.dmp

                                              Filesize

                                              2.3MB

                                              Download

                                            • memory/3904-318-0x0000000000400000-0x0000000000643000-memory.dmp

                                              Filesize

                                              2.3MB

                                              Download

                                            • memory/3904-361-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                              Filesize

                                              972KB

                                              Download

                                            • memory/4772-225-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-74-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-212-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-78-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-231-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-79-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-221-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-76-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-223-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-214-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-75-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-219-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-82-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-235-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-97-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-70-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-81-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-71-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-73-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-210-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-83-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-84-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-85-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-86-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-80-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-77-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-208-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4772-229-0x0000000001080000-0x0000000001261000-memory.dmp

                                              Filesize

                                              1.9MB

                                              Download

                                            • memory/4968-250-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                              Download

                                            • memory/4988-428-0x00000000224B0000-0x000000002270F000-memory.dmp

                                              Filesize

                                              2.4MB

                                              Download

                                            • memory/4988-417-0x0000000000400000-0x0000000000676000-memory.dmp

                                              Filesize

                                              2.5MB

                                              Download

                                            • memory/4988-403-0x0000000000400000-0x0000000000676000-memory.dmp

                                              Filesize

                                              2.5MB

                                              Download

                                            • memory/4988-312-0x0000000000400000-0x0000000000676000-memory.dmp

                                              Filesize

                                              2.5MB

                                              Download

                                            • memory/4988-310-0x0000000000400000-0x0000000000676000-memory.dmp

                                              Filesize

                                              2.5MB

                                              Download

                                            • memory/4988-307-0x0000000000400000-0x0000000000676000-memory.dmp

                                              Filesize

                                              2.5MB

                                              Download

                                            • memory/5084-279-0x00000000006B0000-0x0000000000718000-memory.dmp

                                              Filesize

                                              416KB

                                              Download