Overview

overview

10

Static

static

1

RNSM00397.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    63s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 21:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00397.7z

  • Size

    39.3MB

  • MD5

    e52638e43ebfa52bd5648beeffd931d7

  • SHA1

    96d71bb68432407f54c1bbc80cd8703a0e8ac6dd

  • SHA256

    bb7bb4a8730311f0be23bfa9e365f8fbbe187b598ab86f4205f7f36c0a909a06

  • SHA512

    8434c7ba9ff3725d42f8ab485ea3ef9b38146f74e9f474fe8b5bb903a0473cf63c6569fe8f7f82018770a004d2899ca09d0cd0df65842b731bb0b923eb6c5d2b

  • SSDEEP

    786432:U5gYxvdKaQvCwQ4F390uklGLD74D66AtE6Y5OloJToBEO3z24DYc:CgYtILY4n0uGC7i6noOloyB3DYc

Score
10/10
lockbitnanocoreagilenetdefense_evasiondiscoveryevasionexecutionimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

petroleum.sytes.net:1430

Mutex

c7093f5f-20e4-4efa-a2b8-e96b9af4ad8c

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-07-31T18:09:06.595074836Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    1430

  • default_group

    Revolution

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    c7093f5f-20e4-4efa-a2b8-e96b9af4ad8c

  • mutex_timeout

    5000

  • prevent_system_sleep

    true

  • primary_connection_host

    petroleum.sytes.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Path

C:\Program Files\Crashpad\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?DFB941278EE2558C9775755EED0A433D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?DFB941278EE2558C9775755EED0A433D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?DFB941278EE2558C9775755EED0A433D

http://lockbitks2tvnmwk.onion/?DFB941278EE2558C9775755EED0A433D

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Clears Network RDP Connection History and Configurations 1 TTPs 4 IoCs

    Remove evidence of malicious network connections to clean up operations traces.

    defense_evasion
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Access Token Manipulation: Create Process with Token 1 TTPs 13 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00397.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4676
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2536
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Blocker.gen-52df4354245d7b21810a04ab56ae1099387d777f42a6b9a151f439ecf77c4ce1.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-52df4354245d7b21810a04ab56ae1099387d777f42a6b9a151f439ecf77c4ce1.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1596
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1620
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp81CD.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3332
      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-0d5c9ea7ee730f8fa473c10372413046bbc7e4b21e48c06f509d9fb7159e971f.exe
        HEUR-Trojan-Ransom.MSIL.Crypmod.gen-0d5c9ea7ee730f8fa473c10372413046bbc7e4b21e48c06f509d9fb7159e971f.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2768
      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Encoder.gen-fe5760a742540c74f4eefffaf61de0916393e2d60ce5d1b03e403d9c3e155343.exe
        HEUR-Trojan-Ransom.MSIL.Encoder.gen-fe5760a742540c74f4eefffaf61de0916393e2d60ce5d1b03e403d9c3e155343.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2756
      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Agent.gen-d325a54642f60e944e5789cae90183ccee9ea80e6b292bd5dc20f429644eedd8.exe
        HEUR-Trojan-Ransom.Win32.Agent.gen-d325a54642f60e944e5789cae90183ccee9ea80e6b292bd5dc20f429644eedd8.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2960
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 1612
          4⤵
          • Program crash
          PID:5956
      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Blocker.gen-47ad8bf28075eca489bdf11e8b65b70e0ddb17728c12fd110aa8779cb69f13a1.exe
        HEUR-Trojan-Ransom.Win32.Blocker.gen-47ad8bf28075eca489bdf11e8b65b70e0ddb17728c12fd110aa8779cb69f13a1.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4464
      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Blocker.vho-5bf2529e51a55d00d51c34cbc87d3f813e66e5d7e059b1c6de525abc37af4320.exe
        HEUR-Trojan-Ransom.Win32.Blocker.vho-5bf2529e51a55d00d51c34cbc87d3f813e66e5d7e059b1c6de525abc37af4320.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3504
        • C:\Users\Admin\Desktop\00397\tpvpyme.exe
          "C:\Users\Admin\Desktop\00397\tpvpyme.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5568
          • C:\Windows\splwow64.exe
            C:\Windows\splwow64.exe 12288
            5⤵
              PID:1424
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00397\USB_Habilitar.bat" "
              5⤵
                PID:6604
                • C:\Windows\SysWOW64\regedit.exe
                  REGEDIT /S "C:\Users\Admin\Desktop\00397\USB_habilitar.reg
                  6⤵
                  • Runs .reg file with regedit
                  PID:5204
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00397\windowsUpdate.bat" "
                5⤵
                  PID:2352
                  • C:\Windows\SysWOW64\regedit.exe
                    REGEDIT /S "C:\Users\Admin\Desktop\00397\windowsUpdate.reg
                    6⤵
                    • Runs .reg file with regedit
                    PID:2764
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                  5⤵
                    PID:5160
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update /v AUOptions /t REG_DWORD /d 1 /f
                    5⤵
                      PID:1732
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
                      5⤵
                        PID:6452
                        • C:\Windows\SysWOW64\sc.exe
                          sc config wuauserv start= disabled
                          6⤵
                          • Launches sc.exe
                          PID:2660
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c net stop wuauserv
                        5⤵
                          PID:6800
                          • C:\Windows\SysWOW64\net.exe
                            net stop wuauserv
                            6⤵
                              PID:6624
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop wuauserv
                                7⤵
                                  PID:5400
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
                              5⤵
                                PID:6916
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
                                  6⤵
                                    PID:5836
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
                                  5⤵
                                    PID:3448
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
                                      6⤵
                                        PID:820
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
                                          7⤵
                                            PID:6912
                                  • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Crypren.gen-c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe
                                    HEUR-Trojan-Ransom.Win32.Crypren.gen-c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • System Location Discovery: System Language Discovery
                                    PID:4676
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 564
                                      4⤵
                                      • Program crash
                                      PID:5736
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 656
                                      4⤵
                                      • Program crash
                                      PID:5496
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 664
                                      4⤵
                                      • Program crash
                                      PID:3172
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 684
                                      4⤵
                                      • Program crash
                                      PID:4100
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 872
                                      4⤵
                                      • Program crash
                                      PID:5740
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 968
                                      4⤵
                                      • Program crash
                                      PID:5020
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 980
                                      4⤵
                                      • Program crash
                                      PID:5904
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 968
                                      4⤵
                                      • Program crash
                                      PID:5356
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1168
                                      4⤵
                                      • Program crash
                                      PID:1704
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 968
                                      4⤵
                                      • Program crash
                                      PID:2904
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1224
                                      4⤵
                                      • Program crash
                                      PID:6140
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1232
                                      4⤵
                                      • Program crash
                                      PID:1396
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                      4⤵
                                        PID:5944
                                        • C:\Windows\system32\vssadmin.exe
                                          vssadmin delete shadows /all /quiet
                                          5⤵
                                          • Interacts with shadow copies
                                          PID:6768
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic shadowcopy delete
                                          5⤵
                                            PID:5160
                                          • C:\Windows\system32\bcdedit.exe
                                            bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                            5⤵
                                            • Modifies boot configuration data using bcdedit
                                            PID:5216
                                          • C:\Windows\system32\bcdedit.exe
                                            bcdedit /set {default} recoveryenabled no
                                            5⤵
                                            • Modifies boot configuration data using bcdedit
                                            PID:5204
                                          • C:\Windows\system32\wbadmin.exe
                                            wbadmin delete catalog -quiet
                                            5⤵
                                            • Deletes backup catalog
                                            PID:6512
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1128
                                          4⤵
                                          • Program crash
                                          PID:6764
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 896
                                          4⤵
                                          • Program crash
                                          PID:2344
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 908
                                          4⤵
                                          • Program crash
                                          PID:1704
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 888
                                          4⤵
                                          • Program crash
                                          PID:6880
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 864
                                          4⤵
                                          • Program crash
                                          PID:3608
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 920
                                          4⤵
                                          • Program crash
                                          PID:4916
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1380
                                          4⤵
                                          • Program crash
                                          PID:6688
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1392
                                          4⤵
                                          • Program crash
                                          PID:2352
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 920
                                          4⤵
                                          • Program crash
                                          PID:5912
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1208
                                          4⤵
                                          • Program crash
                                          PID:6684
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 716
                                          4⤵
                                          • Program crash
                                          PID:6236
                                      • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Encoder.gen-06513fdae5353de95be18a039591d3e770223a9d0b3cb4c592b19ed6e69b32ed.exe
                                        HEUR-Trojan-Ransom.Win32.Encoder.gen-06513fdae5353de95be18a039591d3e770223a9d0b3cb4c592b19ed6e69b32ed.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4364
                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GLUpdateFWTool.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GLUpdateFWTool.exe"
                                          4⤵
                                            PID:1796
                                        • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Gen.gen-441088e4c5ec14c414964083af0075b984b3e56f5208c140433ca7bc81242bcd.exe
                                          HEUR-Trojan-Ransom.Win32.Gen.gen-441088e4c5ec14c414964083af0075b984b3e56f5208c140433ca7bc81242bcd.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          PID:3904
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 568
                                            4⤵
                                            • Program crash
                                            PID:5680
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 704
                                            4⤵
                                            • Program crash
                                            PID:5324
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 712
                                            4⤵
                                            • Program crash
                                            PID:3264
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 692
                                            4⤵
                                            • Program crash
                                            PID:1732
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 740
                                            4⤵
                                            • Program crash
                                            PID:3900
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 848
                                            4⤵
                                            • Program crash
                                            PID:6024
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 860
                                            4⤵
                                            • Program crash
                                            PID:3140
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 868
                                            4⤵
                                            • Program crash
                                            PID:5488
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 876
                                            4⤵
                                            • Program crash
                                            PID:3828
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 852
                                            4⤵
                                            • Program crash
                                            PID:2308
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 708
                                            4⤵
                                            • Program crash
                                            PID:5712
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 860
                                            4⤵
                                            • Program crash
                                            PID:3372
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 884
                                            4⤵
                                            • Program crash
                                            PID:5900
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 892
                                            4⤵
                                            • Program crash
                                            PID:5684
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1328
                                            4⤵
                                            • Program crash
                                            PID:5096
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1944
                                            4⤵
                                            • Program crash
                                            PID:6580
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1952
                                            4⤵
                                            • Program crash
                                            PID:6312
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1948
                                            4⤵
                                            • Program crash
                                            PID:6064
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1664
                                            4⤵
                                            • Program crash
                                            PID:6656
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1868
                                            4⤵
                                            • Program crash
                                            PID:1644
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2776
                                            4⤵
                                            • Program crash
                                            PID:3328
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2628
                                            4⤵
                                            • Program crash
                                            PID:5556
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2364
                                            4⤵
                                            • Program crash
                                            PID:6820
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2872
                                            4⤵
                                            • Program crash
                                            PID:6364
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1892
                                            4⤵
                                            • Program crash
                                            PID:6244
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                            4⤵
                                              PID:1104
                                              • C:\Windows\system32\vssadmin.exe
                                                vssadmin delete shadows /all /quiet
                                                5⤵
                                                • Interacts with shadow copies
                                                PID:3428
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic shadowcopy delete
                                                5⤵
                                                  PID:6388
                                                • C:\Windows\system32\bcdedit.exe
                                                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                  5⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:6732
                                                • C:\Windows\system32\bcdedit.exe
                                                  bcdedit /set {default} recoveryenabled no
                                                  5⤵
                                                  • Modifies boot configuration data using bcdedit
                                                  PID:1196
                                                • C:\Windows\system32\wbadmin.exe
                                                  wbadmin delete catalog -quiet
                                                  5⤵
                                                  • Deletes backup catalog
                                                  PID:6660
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 3024
                                                4⤵
                                                • Program crash
                                                PID:6484
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 764
                                                4⤵
                                                • Program crash
                                                PID:7012
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2388
                                                4⤵
                                                • Program crash
                                                PID:7068
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2380
                                                4⤵
                                                • Program crash
                                                PID:6744
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2340
                                                4⤵
                                                • Program crash
                                                PID:5304
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2384
                                                4⤵
                                                • Program crash
                                                PID:6528
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2340
                                                4⤵
                                                • Program crash
                                                PID:5812
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1836
                                                4⤵
                                                • Program crash
                                                PID:6860
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2380
                                                4⤵
                                                • Program crash
                                                PID:5160
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1624
                                                4⤵
                                                • Program crash
                                                PID:5172
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1472
                                                4⤵
                                                • Program crash
                                                PID:6492
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1836
                                                4⤵
                                                • Program crash
                                                PID:6800
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1096
                                                4⤵
                                                • Program crash
                                                PID:5160
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2240
                                                4⤵
                                                  PID:6616
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2336
                                                  4⤵
                                                    PID:4612
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2028
                                                    4⤵
                                                      PID:5784
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1460
                                                      4⤵
                                                        PID:5836
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2240
                                                        4⤵
                                                          PID:6744
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1096
                                                          4⤵
                                                            PID:5616
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1688
                                                            4⤵
                                                              PID:7008
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1688
                                                              4⤵
                                                                PID:2816
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2256
                                                                4⤵
                                                                  PID:6916
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1488
                                                                  4⤵
                                                                    PID:6032
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1652
                                                                    4⤵
                                                                      PID:6040
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1560
                                                                      4⤵
                                                                        PID:6564
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1552
                                                                        4⤵
                                                                          PID:2944
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1548
                                                                          4⤵
                                                                            PID:6888
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1560
                                                                            4⤵
                                                                              PID:1812
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1652
                                                                              4⤵
                                                                                PID:3804
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1512
                                                                                4⤵
                                                                                  PID:2300
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2868
                                                                                  4⤵
                                                                                    PID:5712
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1552
                                                                                    4⤵
                                                                                      PID:6428
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2256
                                                                                      4⤵
                                                                                        PID:6752
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1484
                                                                                        4⤵
                                                                                          PID:1724
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1468
                                                                                          4⤵
                                                                                            PID:4944
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1096
                                                                                            4⤵
                                                                                              PID:4700
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2256
                                                                                              4⤵
                                                                                                PID:2348
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1096
                                                                                                4⤵
                                                                                                  PID:6584
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1476
                                                                                                  4⤵
                                                                                                    PID:1596
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1444
                                                                                                    4⤵
                                                                                                      PID:6900
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1448
                                                                                                      4⤵
                                                                                                        PID:6684
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1476
                                                                                                        4⤵
                                                                                                          PID:6428
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1436
                                                                                                          4⤵
                                                                                                            PID:4220
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1444
                                                                                                            4⤵
                                                                                                              PID:6528
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1448
                                                                                                              4⤵
                                                                                                                PID:4608
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1532
                                                                                                                4⤵
                                                                                                                  PID:5376
                                                                                                              • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Generic-f899ae2fc984188f6cd13d1eca7b031f58f8b6be5a47e023daf340bd850de229.exe
                                                                                                                HEUR-Trojan-Ransom.Win32.Generic-f899ae2fc984188f6cd13d1eca7b031f58f8b6be5a47e023daf340bd850de229.exe
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1644
                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                  REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /t REG_DWORD /v DisableRegistryTools /d 1 /f
                                                                                                                  4⤵
                                                                                                                  • Modifies registry key
                                                                                                                  PID:5908
                                                                                                              • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Stop.gen-6057a2c0e48a6f692d5ef8a36dad893899fd7dcb03067b2729ebe4b04d867357.exe
                                                                                                                HEUR-Trojan-Ransom.Win32.Stop.gen-6057a2c0e48a6f692d5ef8a36dad893899fd7dcb03067b2729ebe4b04d867357.exe
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1020
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\Users\Admin\AppData\Local\b3796345-43f3-4055-8ec1-44ab2060a969" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                  4⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  PID:2956
                                                                                                              • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Blocker.mqfc-1d82e60080a0deb2543e7f5a015b4be0ddb6f5f4768ace5c314607ff5ad8fab3.exe
                                                                                                                Trojan-Ransom.Win32.Blocker.mqfc-1d82e60080a0deb2543e7f5a015b4be0ddb6f5f4768ace5c314607ff5ad8fab3.exe
                                                                                                                3⤵
                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Executes dropped EXE
                                                                                                                • Identifies Wine through registry keys
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3784
                                                                                                                • C:\Users\Admin\AppData\Roaming\Security Center.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Security Center.exe"
                                                                                                                  4⤵
                                                                                                                    PID:5600
                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Security Center.exe" "Security Center.exe" ENABLE
                                                                                                                      5⤵
                                                                                                                      • Modifies Windows Firewall
                                                                                                                      PID:5164
                                                                                                                • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Blocker.mqkq-c164ba38bef4d67b7bc51aacaf06edec1f6d1f97207aaf3539d72ba1630d4f87.exe
                                                                                                                  Trojan-Ransom.Win32.Blocker.mqkq-c164ba38bef4d67b7bc51aacaf06edec1f6d1f97207aaf3539d72ba1630d4f87.exe
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4336
                                                                                                                  • C:\Users\Admin\AppData\Local\TempMicrosoft.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\TempMicrosoft.exe"
                                                                                                                    4⤵
                                                                                                                      PID:368
                                                                                                                  • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Encoder.cya-24d70038e548e6e1322e5922587d803f181a5a0d8ba95a1a264caa93ccc664a7.exe
                                                                                                                    Trojan-Ransom.Win32.Encoder.cya-24d70038e548e6e1322e5922587d803f181a5a0d8ba95a1a264caa93ccc664a7.exe
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4916
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\Admin\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Encoder.cya-24d70038e548e6e1322e5922587d803f181a5a0d8ba95a1a264caa93ccc664a7.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Alternative User Input" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
                                                                                                                      4⤵
                                                                                                                        PID:2200
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Alternative User Input" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
                                                                                                                          5⤵
                                                                                                                            PID:6040
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ctfmon.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
                                                                                                                          4⤵
                                                                                                                            PID:4024
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                              5⤵
                                                                                                                                PID:6916
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                                                                                                                5⤵
                                                                                                                                  PID:7068
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                                                                                                                  5⤵
                                                                                                                                    PID:1732
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
                                                                                                                                    5⤵
                                                                                                                                      PID:7028
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                                                                                                                                      5⤵
                                                                                                                                        PID:6916
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                                                                                                                                        5⤵
                                                                                                                                          PID:5564
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                                                                                                                          5⤵
                                                                                                                                            PID:3132
                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                              wmic shadowcopy delete
                                                                                                                                              6⤵
                                                                                                                                                PID:5160
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                                                                                                                              5⤵
                                                                                                                                                PID:4852
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                                                                                                                                                5⤵
                                                                                                                                                • Clears Network RDP Connection History and Configurations
                                                                                                                                                PID:6468
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                                                                                                                                                  6⤵
                                                                                                                                                  • Clears Network RDP Connection History and Configurations
                                                                                                                                                  PID:5020
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                                                                                                                                                5⤵
                                                                                                                                                • Clears Network RDP Connection History and Configurations
                                                                                                                                                PID:5804
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                                                                                                                                                  6⤵
                                                                                                                                                  • Clears Network RDP Connection History and Configurations
                                                                                                                                                  PID:7036
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                                                                                                                                                5⤵
                                                                                                                                                  PID:6364
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:6704
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1596
                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                        attrib "C:\Users\Admin\documents\Default.rdp" -s -h
                                                                                                                                                        6⤵
                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                        PID:6584
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:6428
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Application
                                                                                                                                                        5⤵
                                                                                                                                                          PID:5804
                                                                                                                                                          • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                                                            wevtutil.exe clear-log Application
                                                                                                                                                            6⤵
                                                                                                                                                            • Clears Windows event logs
                                                                                                                                                            PID:5172
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Security
                                                                                                                                                          5⤵
                                                                                                                                                            PID:5972
                                                                                                                                                            • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                                                              wevtutil.exe clear-log Security
                                                                                                                                                              6⤵
                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                              PID:6544
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log System
                                                                                                                                                            5⤵
                                                                                                                                                              PID:4852
                                                                                                                                                              • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                                                                wevtutil.exe clear-log System
                                                                                                                                                                6⤵
                                                                                                                                                                • Clears Windows event logs
                                                                                                                                                                PID:3448
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\system32\cmd.exe" /C sc config eventlog start=disabled
                                                                                                                                                              5⤵
                                                                                                                                                                PID:5724
                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                  sc config eventlog start=disabled
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:5748
                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Encoder.kvo-c750f7953c86ed18fb1b74a77aac0026129022a502a50fe1ca9b81f336ce1d26.exe
                                                                                                                                                            Trojan-Ransom.Win32.Encoder.kvo-c750f7953c86ed18fb1b74a77aac0026129022a502a50fe1ca9b81f336ce1d26.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2816
                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Gen.das-8befe0dde3fe13d15c5078e435c1c0bd68cda94986ed17ec3af4959e60c6c58f.exe
                                                                                                                                                            Trojan-Ransom.Win32.Gen.das-8befe0dde3fe13d15c5078e435c1c0bd68cda94986ed17ec3af4959e60c6c58f.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3432
                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Gen.rea-4ae06a5c16f58ffc6f39e4d5195484f5be8f90eef26afbdaec45f80e8d14c0b6.exe
                                                                                                                                                            Trojan-Ransom.Win32.Gen.rea-4ae06a5c16f58ffc6f39e4d5195484f5be8f90eef26afbdaec45f80e8d14c0b6.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:1588
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~8ECE.bat Trojan-Ransom.Win32.Gen.rea-4ae06a5c16f58ffc6f39e4d5195484f5be8f90eef26afbdaec45f80e8d14c0b6.exe
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4928
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispCPL /t reg_dword /d 1 /f
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:6644
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t reg_dword /d 1 /f
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:6652
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:6720
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t reg_dword /d 1 /f
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:6212
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t reg_dword /d 1 /f
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:7104
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t reg_dword /d 1 /f
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:2904
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t reg_dword /d 1 /f
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6224
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t reg_dword /d 1 /f
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:5780
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t reg_dword /d 1 /f
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:3240
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t reg_dword /d 4 /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:6284
                                                                                                                                                                                • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Gen.yrv-c96924ee2b3c45ea30868e3765f7dacebf2981356e2665ca856257d0b5f85186.exe
                                                                                                                                                                                  Trojan-Ransom.Win32.Gen.yrv-c96924ee2b3c45ea30868e3765f7dacebf2981356e2665ca856257d0b5f85186.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:3136
                                                                                                                                                                                • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Zerber.gcve-e3f3b0ff21d8be48ecd7dc96b282f14ad94ab712a03c5f4e04cdbfb2d401ca8d.exe
                                                                                                                                                                                  Trojan-Ransom.Win32.Zerber.gcve-e3f3b0ff21d8be48ecd7dc96b282f14ad94ab712a03c5f4e04cdbfb2d401ca8d.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5420
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 232
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:3268
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 236
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:5136
                                                                                                                                                                                  • C:\Users\Admin\Desktop\00397\UDS-Trojan-Ransom.Win32.Petr.atn-e0790af279238c85b255391a0f4e2fbbbde20905dddc44b54f7b18d057e31f1a.exe
                                                                                                                                                                                    UDS-Trojan-Ransom.Win32.Petr.atn-e0790af279238c85b255391a0f4e2fbbbde20905dddc44b54f7b18d057e31f1a.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5240
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:4968
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:6556
                                                                                                                                                                                        • C:\Users\Admin\Desktop\00397\VHO-Trojan-Ransom.Win32.Convagent.gen-c6bb071495ce80f0b5f0ea4d5dab9db6f28c27cc4a068186d41153fcc30b7a90.exe
                                                                                                                                                                                          VHO-Trojan-Ransom.Win32.Convagent.gen-c6bb071495ce80f0b5f0ea4d5dab9db6f28c27cc4a068186d41153fcc30b7a90.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5020
                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\VHO-Trojan-Ransom.Win32.Encoder.gen-d0572013ae3ae9ba1f021ebcb15a7fecf2f16561971d96239fdadad2af6a2db3.exe
                                                                                                                                                                                            VHO-Trojan-Ransom.Win32.Encoder.gen-d0572013ae3ae9ba1f021ebcb15a7fecf2f16561971d96239fdadad2af6a2db3.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5148
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E8E4.tmp\E8E5.tmp\E8E6.bat C:\Users\Admin\Desktop\00397\VHO-Trojan-Ransom.Win32.Encoder.gen-d0572013ae3ae9ba1f021ebcb15a7fecf2f16561971d96239fdadad2af6a2db3.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:5392
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                    • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                      mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                        "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:6856
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F0C4.tmp\F0C5.tmp\F0C6.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                                • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                  mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                  • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                      PID:6196
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F4FA.tmp\F4FB.tmp\F4FC.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                            • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                              mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                              • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                              PID:7036
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:1216
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F95F.tmp\F960.tmp\F961.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                      PID:6684
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                          PID:6268
                                                                                                                                                                                                                                        • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                          mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                          • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                              PID:2680
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FCCA.tmp\FCCB.tmp\FCCC.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                      PID:6320
                                                                                                                                                                                                                                                    • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                      mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FF79.tmp\FF7A.tmp\FF7B.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                              PID:6356
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                  PID:5124
                                                                                                                                                                                                                                                                • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                  mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                  • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                  PID:6248
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                      PID:6536
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\371.tmp\372.tmp\373.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                            reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                            23⤵
                                                                                                                                                                                                                                                                              PID:1228
                                                                                                                                                                                                                                                                            • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                              mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                                                              • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7E6.tmp\7E7.tmp\7E8.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                                                      PID:6732
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                          mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                          • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                                          PID:6444
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                              PID:4700
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FB6.tmp\FB7.tmp\FB8.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                  PID:6544
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                    reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                                      mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                                                      PID:6476
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\17F3.tmp\17F4.tmp\17F5.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                              PID:4208
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                                                                  PID:6700
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                                                  mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                  • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                                                                  PID:6232
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                                                      PID:988
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1CB6.tmp\1CB7.tmp\1CB8.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                            reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                                                                                                                                              PID:2300
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                                                              mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                                                                                                              • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                                                                              PID:6268
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2244.tmp\2245.tmp\2246.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                                                                                                                                      PID:6708
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                          PID:6740
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                                                                          mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                                                                                                          • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\287D.tmp\287E.tmp\287F.bat C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE"
                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg.exe query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mshta.exe
                                                                                                                                                                                                                                                                                                                                                      mshta "vbscript:CreateObject("Shell.Application").ShellExecute("C:\Users\Admin\Desktop\00397\VHO-TR~2.EXE", "", "", "runas", 1) & Close()"
                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                      • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:5592
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2960 -ip 2960
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5868
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:5564
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:5596
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:5668
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:6012
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:988
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5420 -ip 5420
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:5396
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:228
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:5804
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5420 -ip 5420
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:5596
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4708
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:2452
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:3832
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:6000
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:6716
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:6736
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:6916
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6868
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7092
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4228
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:468
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7056
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:772
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6380
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7024
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1732
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6200
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\AUDIODG.EXE 0x524 0x520
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5620
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5284
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4676 -ip 4676
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7028
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6416
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6200
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7052
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6564
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6468
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6492
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6704
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3904 -ip 3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4032

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1047

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Access Token Manipulation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1134

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Create Process with Token

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1134.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Access Token Manipulation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1134

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Create Process with Token

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1134.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1006

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Clear Network Connection History and Configurations

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Clear Windows Event Logs

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1489

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Lagu Baru.exe.-F2266EBC-AF01-22AA-4878-59C38BAC047E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6ae607a8523cb24c812ab80a96fe3cba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7bfad318173f90273350ad3931058343c7277eeb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d555dcd6afd68414287828ecd7f3d7a3c1029690ba873df85acb6f74cbf6eeb2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            688f35ac24306aff2023c71ca0b220433abcf3f8dcae3fb57f7589b8f41862edbfbc59ad0289810a65030a3752bd166452f08365a33298e495cb2807db9acd44

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\MicrosoftSecurity\Microsoft.a3x.lockbit.-F2266EBC-AF01-22AA-4878-59C38BAC047E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            50acc00a2089be66bc489e72fa4c78c1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fa9c8e2c8946be9922957dd64e6207e0e41ef6b3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            f99166fd4099aebdc12f5dea98f75bbb7606d29077ef9968b423c6eac18e8a63

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5c661edf93b0bbae23521fee9dea9f72e95e48b0a5f541ab87e8308081eb85f7cf60991af7340b1dd6b2cc2dbb7485398378593ac44071cf619f7b6d269eaa76

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\MicrosoftSecurity\MicrosoftSecurity.exe.-F2266EBC-AF01-22AA-4878-59C38BAC047E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            776KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fc338ba253bfe761d519aa9427c7d982

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            571753f6003d4825fbb8ebb301c86b246ec01b62

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1ad10548e8681b75af4b4430b8b00cfd711d9704b10a0b9ebe4428f2d9a690fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c0d65a67363b89fb8bba882d9919e49ae8912ee326027227d29884bca229a5fd994ad14e63d2738b37e925b9a2131700185bc39fef38824a05e0ad82c9c138f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Crashpad\Restore-My-Files.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ecd0076dd0f56d40db9623827c77e13e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1e5a0f2953303adf61d96f545445abcd4905771a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a4b1dafb169eac2e063e1d3786770363fe3ccf1001c60a68b4c0a8d9f069dce4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            85741456d457ef24f5b2c43403e02a916ccb98817a99be64c9f7e9185d5c5197c8d748483d0b13e16c12579d268efd25e0973d6de9748dde0227f4cf4a2c0da8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\TempMicrosoft.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fab6b09913a2efeab4c96bef1d379d1a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0c0f48b6e33f3901f328e23226001d28368ed740

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fc3bf35adb3c2d430a3836d284fd2297aa08b5473671da00ec73b00fbad8c4a8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e2ffb1035c408e7932500e7c87a7e9ea08831a6942e596b3b935a8159026df1df6485783da799ce5214f60a9c51bace161fda6b10edd82b3339775fc128af7ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zE44259DE7\00397\Trojan-Ransom.Win32.Zerber.gcwq-6de83cc21cfea0f6744137e991dfe6596417a7780ecdc2227902ae8abe4e27ae.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            536KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            27df64011ab8cc41c54668eb6ecebc5e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            66269d96ea1f56c336673e44880465823bad560d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6de83cc21cfea0f6744137e991dfe6596417a7780ecdc2227902ae8abe4e27ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            30be9488135c2f773b6f5280253faadfd6698928f4043883c3b7255d37fec4b36d24479b63cc5938db5aa537ad1ddac7a2b8b3cfed4e15c0ed06ef9f03b9e1b4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FCCA.tmp\FCCB.tmp\FCCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            787fc1bbdaed5d55014148cb46e85842

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e3f8a84d72e227930864549e4bbf27b28f7ce55e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            90661cc47f8f63b1d2e2109cab7defe31e3adf902330af8d0e9f006f9f5198b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0d1ea3d1741536c85b329d8ccd22a0171b90012043229adef7e49cacfa006abcbc9357b63933a8c636b6e62bd655c2b9f9d7e5764da9c6209c55627c8d53fb1f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FP8613.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            177B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a29e1c95886f5f7ef15760fa97005a10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9631383060741261d56a4091b490f6a5dd1495b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            65c2b4a3530cecffc4ad0117dbdae11d1ca0771b61cabfbe34eb2ce89d51e793

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            33b1dfe4d6848b734bb85747591647649e3ba13e4e88ee3b465e6fba9ae7d9aa592ceb61afb1d2217a700a5c48531346f55b928615f60526400d26de00bf206b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            b1e5216e60efac440cef3cb09dfd025e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            642fb629df3a898f04c7d771b423d4a476d7d314

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6fd27ea0cbfd63062f7ae3f8b8f3ccb5b8bafb99208b94da8d7c2020a52ab41d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7a3cdd4e6588371c7dc76507df3d566b0f9c8c3ead1f3873dcc840bd2d84ce1859e43935b33663befde2659329f4a9ca16c0500df6dd3d4577ac4ea12cecff00

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Config\UpgradeTool.dno
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bb6994786f48f285569ce517076cb0ca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            842f1927c1bdd44fe4e86b3494189bd4f96b0666

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            114ee23525a4439badec3f7315ce7cfc4c86ba1f9dc7b4521ff0f7851bf8fc16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1963bd4a9bb5a7f8d2166ce1baf456d782849984c23855c3ff23c58c16d9220baf8231a0041453864d613d548ac3252ede2c282aba5b6da54f61c02aca213e84

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GLUpdateFWTool.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            45b6046b33c62b72e5e0ed861a6388d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4a862fdbfa978a99f174979b06a8b0f2bbeb4728

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6c02dba872b04b221a2f86393fdcf88d61c778e96cc420344b1e812d7c406f73

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            af3653188c2a2f1f3b3d89831472c2f62224b1892e19e0a79e359b807aa0c921789035e0615dc2eb37fe55494f1d296a786540489e1f7ce06e149db4d50242e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\glScript.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            116KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192bcdf13cba87765bc776ffb175144a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287de486755ac7a2dbc91a28c3443775374fcd33

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8fb9ef488e77c92aca3c0802435da3d2edf236b1adafba0c1ee3bb903400d7a0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2fe1f761c196d456eaf0753e3adae39c5d82acda7f3735b6d0919dfae60d69b88cc0aaeaddb639b25506ce688566e516102f640dc7bd79e5c05857965b9bb53a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ustor.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            390KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0173404c985349d7c3a2e06b8fb1b7c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d3fcb58ee290322f4dd8d3ee68e5f2bf48ccad02

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            794c2eadfa37015d97f8ed260b518a7e94f709f9d42d1d6dc197fbcdb532c6fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a4797ee5c72071f3bab56d251105d32d2ff32d0e989b10d0b04e8f20fdac3d8f846f6f3f068812d33235f7d0665bb45499e93106be9f47754ec83bd6f3f159b0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zsu5bst.soq.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\autB14B.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            61KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fc2d63ddc5ef74d758f087f662d8213e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            93316a807826f39b6f68a5e3462f2fd9fc3bf0ac

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8642639a279d100883997aeb5fe2a6e4d20e6272a35311681d4c58132aac7bcf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            be3682193216b51c7612c60a93302fd52befc62345d3a3c4a50747a612f004f4bd7167a34e6800ca3aebaffa1fa0f16ccdb0d75c1cca44656d59a0baead1ef17

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp81CD.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            48ef7fa9033389ad7929d7a6b9d10298

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9db6cb7325c8bdf66a15f7b5f34703709a45aeb6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0c1b5f67eeb276d1d4205b138ce32bc6149924e02281a2db8e4623a700e88f15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ac8bd104ecbacc9bccce9e087f67e5b18072d59367ccd31d4e66132b6baaea520cba5b9b59464483d86abf74826b382c402f12e9a586c99bda8c78a0de33944e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\~8ECE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e376054ceb07e6c9c867512899585de7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3066f6cfb4b1317e3641ba3d1e3d9feb8eb6c268

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17b83917150b4e07bb9fb459336fae2e6119d830650d2d44b0b0167fef519cef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            60c44cadc0467318cc7125e8993e1bfd1869f87b78dec5e86b0b7fbde2580177c3221ea99aa7684264b2accecf574ad7ce5cadbf02f2571b005a09265443025f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Blocker.gen-52df4354245d7b21810a04ab56ae1099387d777f42a6b9a151f439ecf77c4ce1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            630KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            910759e67118794e7b7f7f18d291f985

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            f2f29d0cabbe2ce93078f0ca48439353284f5822

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            52df4354245d7b21810a04ab56ae1099387d777f42a6b9a151f439ecf77c4ce1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            13a773c85ebd76c4d7155ff5f635ba4bbb35dbf2da9c86c764e62e04fe5f309e475ae2a223b857cb686969efc5196e7368476dd5e01c123851a3c9e450359acf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-0d5c9ea7ee730f8fa473c10372413046bbc7e4b21e48c06f509d9fb7159e971f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a7ad1abcc1d50c23c310162c6a809500

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6f12029ee1a7cfe08cd4be0d229cc258c34033dc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0d5c9ea7ee730f8fa473c10372413046bbc7e4b21e48c06f509d9fb7159e971f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9cc44c667ab67df8ed9c87fb5a8115f87a7cf6499d62b5c4fb39007609d5928aacb845950bfc335e5e14f45ccf3c1b5114535551ea65dd8901e4e1f7eb05e7c2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Encoder.gen-fe5760a742540c74f4eefffaf61de0916393e2d60ce5d1b03e403d9c3e155343.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2c6a48974fbd9847d9b5d72b70f31694

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a4941f73dd5d59e2bb2ff03eb1dc298d1064e25a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fe5760a742540c74f4eefffaf61de0916393e2d60ce5d1b03e403d9c3e155343

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            70109ac34edfad9602b40d7642d471507b005ca3207b50c99509e535e58bc719e08f248b0fe9f6cf99b95d5140d0ea97c69ceec66b00e1b55fc29216354e59f8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.MSIL.Fasem.c-e5f708ded1e19cfae45def5f0001f49a4b869310e1d5c0d11ec8ab54827cdcdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3a8e55138ab329d7894d90982e03ad64

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cf24dba922ad4df96ff1499dc0dde70ac2daae65

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e5f708ded1e19cfae45def5f0001f49a4b869310e1d5c0d11ec8ab54827cdcdf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c929625d3a7ccd44a9b92463cf8dea9f3daddbc96891a526211709134dcf2dd2e3fca3fa51f862783cebc9bdd4b10d7af56dd772ed1e357237f24bae726b3264

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Agent.gen-d325a54642f60e944e5789cae90183ccee9ea80e6b292bd5dc20f429644eedd8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            577KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            42fef74024f4c4d28ef88dd7bed099af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            02c3f3a9dc76b4522b99eee49c70a6f75fd8cf1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d325a54642f60e944e5789cae90183ccee9ea80e6b292bd5dc20f429644eedd8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            eb47c4b3f4900c7807ecc19b703a64e9782382b48f6e6f097440612911dbe01d67629f21facd2bcc7314e3db424ed77440217d9c9e5b37eaa8fe0062cdd2f0d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Blocker.gen-47ad8bf28075eca489bdf11e8b65b70e0ddb17728c12fd110aa8779cb69f13a1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d173edb7a698001d72db7748bf566f21

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            38b5c538128fafe457b6aff5a1025ad061d6fd82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            47ad8bf28075eca489bdf11e8b65b70e0ddb17728c12fd110aa8779cb69f13a1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9c43a024728f44916cc90067b7263a5ffb0cbcbe714aa2fef8e2832557625dd98f2bd0afb595703371e0adf2c9613e65e093bdfab9068e79a1045b976177d2bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Blocker.vho-5bf2529e51a55d00d51c34cbc87d3f813e66e5d7e059b1c6de525abc37af4320.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            18.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e6f3ceda9915b4678a4c0df8fda66cb6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ba6b04f99f5d4e9b33a003234ca56493dd7a1860

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5bf2529e51a55d00d51c34cbc87d3f813e66e5d7e059b1c6de525abc37af4320

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            545481c8dba596562011388c969297d12a5cf9f5ef431ce5c6b8fd5ac08c1fe36d8329ec11692732937027f5dd4f3742be978d6456e65498e34b0e7ec1c190ff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Gen.gen-441088e4c5ec14c414964083af0075b984b3e56f5208c140433ca7bc81242bcd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            52e3ad6ef5d3a43c7c0669659746335f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            838e354175f9cbcee7329fff53dfc559db0c8245

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            441088e4c5ec14c414964083af0075b984b3e56f5208c140433ca7bc81242bcd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0e5c7ac780d2c8dfc7e73edc79558fa0837265d660e09a5182899f3f938c9667371e7edfb840e8227df5234a1069abb65a3852bb44aeb710b92c19166d4505de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\HEUR-Trojan-Ransom.Win32.Generic-f899ae2fc984188f6cd13d1eca7b031f58f8b6be5a47e023daf340bd850de229.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c864d2444a15fd15546292168f2694f8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            146392c091a733fd9b22474e7b9c0cea3927f2f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            f899ae2fc984188f6cd13d1eca7b031f58f8b6be5a47e023daf340bd850de229

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0088047e494d56d62df24fa7a103ae2f83d120f83d16aa38495616d2161ee9feb2055c99be3cbf0e1854a7168b79bb7c5d917f4f74cfe83f2cced3673238e70f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Setting\TPV.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            97B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7bc1c361647436758a78a34e07dff2ae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8be9404817458b447190a3b4e7a72d4e3379b21a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            047d171895f7be57fbf0387f66486354711b373a3d8d3cca1daa7fa04e582e6b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5dc78e6e815f4be6c82eba09f4b0d0ae893f5ba57b5849b9a83aaec9c64a652e69888cb9d007116dafad1dc2105fd812d4637b0ec3dbf153e67d5c7b42d9b388

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Setting\Ventas.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            364B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cba317dfea836f356048198749c3d13f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            737a54b7233f364660081b2d46f5fbb27b6dad0e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7ffb3afd83c9f5eb79e01e28a469725b5cdaa9e91e0c76025163fd77eae71f24

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ea04822857b8e169fd4d0350c134b00b3ebdfaa05f85a850b0c0e95e7988d7dac47d631be88b6a31f845d5492ddf6e5de6921eeab71293b776c30ccb8f89da8d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Blocker.mqfc-1d82e60080a0deb2543e7f5a015b4be0ddb6f5f4768ace5c314607ff5ad8fab3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4072ad20c5a9951e798172465f44b7c5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9dd5ca696bac042f330ff8b2a75bd2d1ded9ed2e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1d82e60080a0deb2543e7f5a015b4be0ddb6f5f4768ace5c314607ff5ad8fab3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ccd8fe8ab6ba78598a59d394e3d65858a3db2a15965f461e12c0a5630791394e5a040a943f8be22fbd4da94d2174b718bbca0235aa2c7090ef91d8ebbf23ade7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Encoder.cya-24d70038e548e6e1322e5922587d803f181a5a0d8ba95a1a264caa93ccc664a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            824c20b4ba06bd9ec5ed999cb7525b36

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c6e2707673294e7000d389405db0718c7c5a980c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            24d70038e548e6e1322e5922587d803f181a5a0d8ba95a1a264caa93ccc664a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            b523b224946e482411de1e34efc8cd40ee831b4c7c27bcbe3670fcb98b7ae9871d494bb4f4fe441c277ab846539a2d258be8967eb7c3e943eb25231c426cd82b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Gen.rea-4ae06a5c16f58ffc6f39e4d5195484f5be8f90eef26afbdaec45f80e8d14c0b6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2be5530ef419662fdcc5d649412c2bfc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            879e6281bce1d81e882895c96fe93fb597e65b3d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4ae06a5c16f58ffc6f39e4d5195484f5be8f90eef26afbdaec45f80e8d14c0b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            48be94eb0eee69a89388060eee4b2f547911a6dba64b5b63ac73941ee5fdfb78bc47e2210555e7e09a88a3cffd0657f33829ce2fbf70509b8e2e1fcbf46c04dc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Gen.yrv-c96924ee2b3c45ea30868e3765f7dacebf2981356e2665ca856257d0b5f85186.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            517KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0b5f30c359b2695c2b70cc04fba88f22

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bbee0cb84ff4574cc4227993fb9804a07a5fcc68

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c96924ee2b3c45ea30868e3765f7dacebf2981356e2665ca856257d0b5f85186

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3b84c3a53afaf03564d43500d14da807ef78c537de838a836f74f9b16d49ef823595174a60b259aabe6e137adbfb2da41506dad93a230814560dfcba64c04906

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Wanna.c-efacf8ce73f1a16c49244018fd07849ec9f49845545e68aa9ec769d9145e42f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            87KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2d4e9767ff351885d239133cafc75b9e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            89dd284643944f52c80d7b3b5e77b09a207416f8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            efacf8ce73f1a16c49244018fd07849ec9f49845545e68aa9ec769d9145e42f7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9e5efbe7c85f8734a39f5cb68db878ff7d7ef12e4618d71d6ea916237bfd6e0333ed7cef00c309faaed55baa421aa9ccd57351be17c2bd45bd4be7e18b3686a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Wanna.zbu-7e48d927413136d1f63189287e5796698bec074dbb53214866ef2e80614d96c9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2d720dee23d452c30b1daee1cc48f8e2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            31f8e60d83b4ec785ede36c6564e121f23dbfe5e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7e48d927413136d1f63189287e5796698bec074dbb53214866ef2e80614d96c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bf7a34626735a33e8e024a21cb16a5b4fd26ab0052b046af59347329e4222d921d68752582d9cdea70e3a9a13c3da17d65ee9f05ccaaafaa4585b20ad9de5183

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Zerber.gctx-07188bbe639a28c5f464166f2fc7cd2215b320a49e46fda3935600e27f680690.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            540KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0fb8a3b4a12e472e8000c5da953d25e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            091ec5bfec09f087a23e9758b01945d20a8f03fe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            07188bbe639a28c5f464166f2fc7cd2215b320a49e46fda3935600e27f680690

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            16a4b764f4738dc11c0c4aab3c2b77c347d2008945ffb4a0fed7910b072f72c16ca707b70948383ce91164a33c62804360706070b7df1967616db7be02792a16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Zerber.gcug-5ff9c1637bc13dc022416767c6f35f75869199b17e86ad71b4dadaaeed8ee3d5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            536KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            82f3304430a13dac0ec3e8642b74a318

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96cfe59c40d60eec7d8a84cf75cfa147169d16c1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5ff9c1637bc13dc022416767c6f35f75869199b17e86ad71b4dadaaeed8ee3d5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c5bcaba80721fb99384e157c7b56eac428b677d5f11bbd3439110c20adfe7ea8a2a995bea1cf6c2bf4e07b241d900f98c9ae07ccd5275fe0bb389233abcfb67b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\Trojan-Ransom.Win32.Zerber.gcve-e3f3b0ff21d8be48ecd7dc96b282f14ad94ab712a03c5f4e04cdbfb2d401ca8d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            327KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bbb8f36d064450c3faf519170e839160

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12d79c96a28a6715331c58178701e413cbb5321d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e3f3b0ff21d8be48ecd7dc96b282f14ad94ab712a03c5f4e04cdbfb2d401ca8d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5623d6d78a2bef87fe46f2515476ea7c85cc08ac865213a1958f7c3a461c5f6481e970fc767b5185e0da9f407e3ffaec5295a9d3c58b3063a8d6c36e37fe394c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00397\autorun.inf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            33B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9914e72d31d9ec29fd9e46aae2c89347

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4238afc32c84f4d3d66541c7b2ca0a1a8bc8831e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6f855c2ab6d0f133b73b5f38e284e1b48e88ba732cd8fecdd8f696970eaddff4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0de09bdb5cef8ab2bc98afe7f3ff9c354f09d72a4b9763af69280eb93070308557bdf5e9d82d142656f9c226238729ca2a40f3ee487025614a3ff4a0b9279b8c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.-F2266EBC-AF01-22AA-4878-59C38BAC047E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            381KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7b7e659ab1f8298d27611b08c20e550b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9a99173a2b62121b2f367cb5209a274bf9f3d16b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4e6720889f46dba14b1f419665d99403e037d1e14c6bad837b8d93c47ae2b919

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c357409bd191e46347a42781a323c813e60462ae34c8a89af863dad16f4573096680b43be4de212a86821ab29b0c36fcffed13deae097d58d37c80783c4044a1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.-F2266EBC-AF01-22AA-4878-59C38BAC047E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            397KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            b354971e43f51bbc1bba5ce9390a9925

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            81b59b6be121497dde2033b6275dc8ec7f410d91

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0c1a4ffc1299d3f58bc4b774cae5ec68665d94583671c9535c218f338d6befea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7169abec6d3d56e0939bfe44dda5524dab68cac0c9385eb59ce5cb304f78fbe3b76d4440bc38faf10359aa141cf0b156b4621689e975e39f1dabcca5ce960720

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • F:\Lagu Baru.exe.-F2266EBC-AF01-22AA-4878-59C38BAC047E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6083939b2b806b5c68ffab4d4e3315d5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            d190a5893b8af4ac40ebf88992572559ef301d82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9551bc70bb9e8a9aa1930bfa3497e771b5a0d2ce4ea998943aa2471927f081ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            779ea3ff62f3db3130feee29e7a46318d1dd97c6173327329d124220edf50fab3010c0dc81dfacdd18f6820808f55c3039eac94975257942db5cbfb666f98b7c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\users\admin\desktop\00397\heur-trojan-ransom.win32.crypren.gen-c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            445KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1a7eb7fc0b6c28388e1f1e3beab03892

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0fdbdc0e8aa192f245ce68888012313c81a95be0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            b08ad87c757236e1eaa3669c185610aae19c83ed51248d9bbeb7c5ded936d6ce45f7fe7fc71b9fdbec1fb2ace9bac397d0e72b3b885917a9f6f0030c8ecddc1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\users\admin\desktop\00397\heur-trojan-ransom.win32.encoder.gen-06513fdae5353de95be18a039591d3e770223a9d0b3cb4c592b19ed6e69b32ed.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c50df40fe6c53c8ee4b87aa027c0310f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0d88fdf59f4c0fdaab8f4f9bc8464f70d2524986

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            06513fdae5353de95be18a039591d3e770223a9d0b3cb4c592b19ed6e69b32ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bf6acbf85c4777528169606243c17ba7ce1633a92b7385b3e06d064ad9527f7360ba920ec77c22a2ab63a77f2cd119077eebf39432c55fc830ec529a7b714f87

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\users\admin\desktop\00397\heur-trojan-ransom.win32.stop.gen-6057a2c0e48a6f692d5ef8a36dad893899fd7dcb03067b2729ebe4b04d867357.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            717KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ec1f882fed68568e7a71476703436b66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7e471c6874552796e4373e427f1acf2fb99355e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6057a2c0e48a6f692d5ef8a36dad893899fd7dcb03067b2729ebe4b04d867357

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            85f4bd77c6254835cb6df61164dd06f875d14275b08f26285324074b61cd3f8f22491def1d55e221a151dd196de371fc25e2a0a33cd5878393fe48d4698fb0eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\users\admin\desktop\00397\trojan-ransom.win32.blocker.mqkq-c164ba38bef4d67b7bc51aacaf06edec1f6d1f97207aaf3539d72ba1630d4f87.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bb19bfcfc2712461a04a6a54ec8da3eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a10c0e5b3751ddb0f206776c35bb8fa3bd1b199a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c164ba38bef4d67b7bc51aacaf06edec1f6d1f97207aaf3539d72ba1630d4f87

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ff554490f30e8da6a5e8bb0141ae5b552c4d87c0e48bb6fa1b23f02898bfa650f36b0bda8f7e1cd08be9557386af9e9854cfc5d0f52dac830d6980a46ca18c58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\users\admin\desktop\00397\trojan-ransom.win32.encoder.kvo-c750f7953c86ed18fb1b74a77aac0026129022a502a50fe1ca9b81f336ce1d26.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            48416e7df40766255fdcb5632257e3f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8d68b5713a6788db4b80edda58326396eb397fb6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c750f7953c86ed18fb1b74a77aac0026129022a502a50fe1ca9b81f336ce1d26

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7976993bceee66ae87e0a2f2e1880b8d0dcbc14a7207097958a09730da32941daf24a60f135691f56a6b4eb5e0a5f056103cc686b181687305de8e5eb267b38a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\users\admin\desktop\00397\trojan-ransom.win32.gen.das-8befe0dde3fe13d15c5078e435c1c0bd68cda94986ed17ec3af4959e60c6c58f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dba70fa8ee75ff31a72e7d8312175e13

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            438e7417f3cf346cec6d8436ede6fb4942101d53

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8befe0dde3fe13d15c5078e435c1c0bd68cda94986ed17ec3af4959e60c6c58f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7062cc93dc7db6cf0c1bcb8d5ea99cd4e62b4afa792ac8e1034e075f14c94efc785e2548c011222d358ed6881c3237208e2dc44b1e110559e49282ed09213a77

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1588-241-0x0000000000400000-0x000000000075B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1588-488-0x0000000000400000-0x000000000075B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1596-121-0x00000000008F0000-0x0000000000994000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            656KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1596-132-0x00000000055D0000-0x0000000005610000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1596-124-0x0000000005250000-0x00000000052E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1620-167-0x00000000050D0000-0x00000000050DA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1620-161-0x0000000000400000-0x0000000000438000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1620-168-0x00000000052C0000-0x00000000052DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1620-169-0x00000000055F0000-0x00000000055FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2332-103-0x000001667AAE0000-0x000001667AB24000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2332-98-0x000001667A460000-0x000001667A482000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2332-104-0x000001667ABB0000-0x000001667AC26000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2332-106-0x000001667AB50000-0x000001667AB6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-87-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-86-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-85-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-84-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-88-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-89-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-77-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-78-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2536-79-0x000002DFF2FD0000-0x000002DFF2FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-129-0x0000000004F70000-0x0000000004FC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-128-0x0000000004D70000-0x0000000004D7A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-122-0x0000000000410000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-125-0x0000000000E20000-0x0000000000E30000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-126-0x0000000004DD0000-0x0000000004E6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-127-0x0000000005420000-0x00000000059C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2768-116-0x0000000000FC0000-0x0000000000FD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2960-177-0x00000000025F0000-0x00000000025F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2960-176-0x0000000000430000-0x00000000004CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            616KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2960-204-0x0000000004F00000-0x0000000004F70000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            448KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2960-218-0x00000000025A0000-0x00000000025A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-254-0x00000000024C0000-0x000000000252A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            424KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-296-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-272-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-266-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-256-0x0000000002530000-0x000000000259A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            424KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-270-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-268-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-372-0x00000000054C0000-0x00000000054FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-264-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-276-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-298-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-274-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-282-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-286-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-288-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-291-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-257-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-278-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-258-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-260-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-262-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-280-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-284-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-292-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3136-294-0x0000000002530000-0x0000000002593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            396KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3432-470-0x0000000000DF0000-0x000000000135D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3432-2530-0x0000000000DF0000-0x000000000135D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3432-232-0x0000000000DF0000-0x000000000135D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3504-182-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3504-371-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3784-226-0x00000000006C0000-0x0000000000B52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3784-445-0x00000000006C0000-0x0000000000B52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-72-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-71-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-64-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-76-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-75-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-65-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-74-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-66-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-70-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3976-73-0x000002614CFA0000-0x000002614CFA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4336-361-0x000000001BF70000-0x000000001BFBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4336-360-0x000000001B050000-0x000000001B058000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4336-247-0x000000001B130000-0x000000001B1D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            664KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4336-255-0x000000001BCC0000-0x000000001BD5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4336-249-0x000000001B6B0000-0x000000001BB7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5020-3847-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5600-3886-0x00000000006C0000-0x0000000000B52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5600-471-0x00000000006C0000-0x0000000000B52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6556-3923-0x0000000000400000-0x00000000007C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6556-4341-0x0000000000400000-0x00000000007C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download